This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8607 in repository https://gitbox.apache.org/repos/asf/allura.git
commit 8ab23957448e85b1549bb240728d4239c933fb43 Author: Dave Brondsema <[email protected]> AuthorDate: Fri May 15 13:05:16 2026 -0400 [#8607] add comments, add test --- Allura/allura/lib/widgets/resources/js/combobox.js | 2 +- Allura/allura/tests/functional/test_home.py | 9 +++++++ Allura/allura/tests/test_helpers.py | 31 ++++++++++++++++++++++ 3 files changed, 41 insertions(+), 1 deletion(-) diff --git a/Allura/allura/lib/widgets/resources/js/combobox.js b/Allura/allura/lib/widgets/resources/js/combobox.js index 782147620..9c6762bf6 100644 --- a/Allura/allura/lib/widgets/resources/js/combobox.js +++ b/Allura/allura/lib/widgets/resources/js/combobox.js @@ -140,7 +140,7 @@ input.autocomplete('instance')._renderItem = function(ul, item) { return $('<li>') .data('item.autocomplete', item) - .append('<a>' + item.label + '</a>') + .append('<a>' + item.label + '</a>') // escape_html not needed, its already used above .appendTo(ul); }; diff --git a/Allura/allura/tests/functional/test_home.py b/Allura/allura/tests/functional/test_home.py index b98c5ba7d..8f4047320 100644 --- a/Allura/allura/tests/functional/test_home.py +++ b/Allura/allura/tests/functional/test_home.py @@ -191,6 +191,15 @@ def test_users(self): }] assert j['options'] == expected + def test_users_json_endpoint_escaped(self): + # escaping also tested by test_json_encoding_directly but that is more low-level this is more functional + + M.User.by_username('test-admin').display_name = 'Test Admin <b>foo</b>' + ThreadLocalODMSession.flush_all() + r = self.app.get('/p/test/users') + assert r.json['options'][0]['label'] == 'Test Admin <b>foo</b> (test-admin)' # JSON interpreted ok + assert 'Test Admin \\u003Cb>foo\\u003C/b> (test-admin)' in r.text # raw value is escaped + def test_members(self): nbhd = M.Neighborhood.query.get(name='Projects') self.app.post('/admin/groups/create', params={'name': 'B_role'}) diff --git a/Allura/allura/tests/test_helpers.py b/Allura/allura/tests/test_helpers.py index 9d8f64c22..b442842d1 100644 --- a/Allura/allura/tests/test_helpers.py +++ b/Allura/allura/tests/test_helpers.py @@ -271,6 +271,27 @@ def test_render_any_markup_plain(): 'readme.txt', '<b>blah</b>\n<script>alert(1)</script>\nfoo') == '<pre><b>blah</b>\n<script>alert(1)</script>\nfoo</pre>') +def test_render_any_markup_plain_code_mode_inline(): + assert ( + h.render_any_markup( + 'readme.txt', '<b>blah</b>\n<script>alert(1)</script>\nfoo', + code_mode=True, linenumbers_style=h.INLINE) == + '<div class="codehilite"><pre><span id="l1" class="code_block"><span class="lineno">1</span> ' + '<b>blah</b></span><span id="l2" class="code_block"><span class="lineno">2</span> ' + '<script>alert(1)</script></span><span id="l3" class="code_block"><span class="lineno">3</span> ' + 'foo</span></pre></div>') + +def test_render_any_markup_plain_code_mode_table(): + assert ( + h.render_any_markup( + 'readme.txt', '<b>blah</b>\n<script>alert(1)</script>\nfoo', + code_mode=True, linenumbers_style=h.TABLE) == + '<table class="codehilitetable"><tbody><tr><td class="linenos"><div class="linenodiv"><pre>1\n' + '2\n' + '3</pre></div></td><td class="code"><div class="codehilite"><pre><span id="l1" class="code_block"><b>blah</b>\n' + '</span><span id="l2" class="code_block"><script>alert(1)</script>\n' + '</span><span id="l3" class="code_block">foo</span></pre></div></td></tr></tbody></table>' + ) def test_render_any_markup_formatting(): assert (str(h.render_any_markup('README.md', '### foo\n' @@ -280,6 +301,16 @@ def test_render_any_markup_formatting(): '<script></span>alert(1)<span class="nt">' '</script></span>bar\n</code></pre></div>\n</div>') +def test_render_any_markup_rst(): + assert (str(h.render_any_markup('README.rst', 'foo\n===\n\nbar\n<script>alert(1)</script>')) == + '<div class="document">\n' + '<div class="section" id="foo">\n' + '<h1>foo</h1>\n' + '<p>bar\n' + '<script>alert(1)</script></p>\n' + '</div>\n' + '</div>\n') + def test_render_any_markdown_encoding(): # send encoded content in, make sure it converts it to actual unicode object which Markdown lib needs
