Add test for issue #494

Signed-off-by: Roberto Rosario <roberto.rosario@mayan-edms.com>

.gitlab-ci.yml

@@ -152,7 +152,7 @@ job_push_python:
     - locale-gen en_US.UTF-8
     - update-locale LANG=en_US.UTF-8
     - export LC_ALL=en_US.UTF-8
-    - apt-get install -qq curl exiftool gcc ghostscript gnupg1 graphviz libfuse2 libjpeg-dev libmagic1 libpng-dev libtiff-dev poppler-utils libreoffice poppler-utils python-dev python-virtualenv python3-dev tesseract-ocr tesseract-ocr-deu
+    - apt-get install -qq curl exiftool firefox-geckodriver gcc ghostscript gnupg1 graphviz libfuse2 libjpeg-dev libmagic1 libpng-dev libtiff-dev poppler-utils libreoffice poppler-utils python-dev python-virtualenv python3-dev tesseract-ocr tesseract-ocr-deu
     - virtualenv venv -p /usr/bin/python3
     - . venv/bin/activate
     - pip install -r requirements.txt -r requirements/testing-base.txt

HISTORY.rst

@@ -17,6 +17,8 @@
   report and research.
 - Add transaction handling to the interval sources delete and save
   methods.
+- Add support for functional tests using selenium.
+- Add test for issue #494.
 
 3.3.5 (2019-12-13)
 ==================

mayan/apps/appearance/apps.py

@@ -6,6 +6,7 @@ from mayan.apps.common.apps import MayanAppConfig
 
 
 class AppearanceApp(MayanAppConfig):
+    has_tests = True
     name = 'mayan.apps.appearance'
     verbose_name = _('Appearance')
 

mayan/apps/appearance/tests/test_views.py

@@ -0,0 +1,27 @@
+from __future__ import absolute_import, unicode_literals
+
+from selenium.webdriver.firefox.webdriver import WebDriver
+
+from django.conf import settings
+from django.contrib.staticfiles.testing import StaticLiveServerTestCase
+from django.urls import reverse
+
+
+class BasePlainViewTestCase(StaticLiveServerTestCase):
+    @classmethod
+    def setUpClass(cls):
+        super(BasePlainViewTestCase, cls).setUpClass()
+        cls.selenium = WebDriver()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.selenium.quit()
+        super(BasePlainViewTestCase, cls).tearDownClass()
+
+    def test_login_view_url_fragment_xss(self):
+        url = '{}{}{}'.format(
+            self.live_server_url, reverse(viewname=settings.LOGIN_URL),
+            '#javascript:alert("XSS")'
+        )
+        self.selenium.get(url=url)
+        self.selenium.find_element_by_xpath(xpath='//button[@name="submit"]')

mayan/apps/common/dependencies.py

@@ -4,9 +4,11 @@ from django.utils.translation import ugettext_lazy as _
 
 from mayan.apps.dependencies.classes import (
     environment_build, environment_development, environment_documentation,
-    environment_testing, PythonDependency
+    environment_testing, BinaryDependency, PythonDependency
 )
 
+from .literals import DEFAULT_FIREFOX_GECKODRIVER_PATH
+
 PythonDependency(
     copyright_text='''
         Copyright (c) Django Software Foundation and individual contributors.
@@ -332,6 +334,11 @@ PythonDependency(
 
 # Testing
 
+BinaryDependency(
+    environment=environment_testing, label='firefox-geckodriver',
+    module=__name__, name='geckodriver',
+    path=DEFAULT_FIREFOX_GECKODRIVER_PATH
+)
 PythonDependency(
     environment=environment_testing, module=__name__, name='codecov',
     version_string='==2.0.15'
@@ -349,6 +356,10 @@ PythonDependency(
     module=__name__, name='django-test-without-migrations',
     version_string='==0.6'
 )
+PythonDependency(
+    environment=environment_testing, module=__name__, name='selenium',
+    version_string='==3.141.0'
+)
 PythonDependency(
     environment=environment_testing, module=__name__, name='tox',
     version_string='==3.8.6'

mayan/apps/common/literals.py

@@ -3,6 +3,7 @@ from __future__ import unicode_literals
 from django.utils.translation import ugettext_lazy as _
 
 DEFAULT_COMMON_HOME_VIEW = 'common:home'
+DEFAULT_FIREFOX_GECKODRIVER_PATH = '/usr/bin/geckodriver'
 DELETE_STALE_UPLOADS_INTERVAL = 60 * 10  # 10 minutes
 DJANGO_SQLITE_BACKEND = 'django.db.backends.sqlite3'