This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8607 in repository https://gitbox.apache.org/repos/asf/allura.git
commit 879aa18a693319fca93d2d083c8d25e97cb98cfb Author: Dave Brondsema <[email protected]> AuthorDate: Wed May 13 13:15:04 2026 -0400 [#8607] test for oembed output security --- Allura/allura/tests/test_globals.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Allura/allura/tests/test_globals.py b/Allura/allura/tests/test_globals.py index 09d40cb64..0c7331d02 100644 --- a/Allura/allura/tests/test_globals.py +++ b/Allura/allura/tests/test_globals.py @@ -348,12 +348,14 @@ def test_macro_include_permissions(self): def test_macro_embed(self, oembed_fetch): oembed_fetch.return_value = { "html": '<iframe width="480" height="270" src="http://www.youtube.com/embed/kOLpSPEA72U?feature=oembed"; ' - 'frameborder="0" allowfullscreen></iframe>)', + 'frameborder="0" allowfullscreen></iframe>' + '<script>alert(1)</script>)', # not realistic, but testing if the oembed endpoint got compromised "title": "Nature's 3D Printer: MIND BLOWING Cocoon in Rainforest - Smarter Every Day 94", } r = g.markdown_wiki.convert('[[embed url=http://www.youtube.com/watch?v=kOLpSPEA72U]]') assert ('<p><iframe height="270" ' - 'src="https://www.youtube-nocookie.com/embed/kOLpSPEA72U?feature=oembed"; width="480"></iframe></p>' in + 'src="https://www.youtube-nocookie.com/embed/kOLpSPEA72U?feature=oembed"; width="480"></iframe>' + '<script>alert(1)</script></p>' in r.replace('\n', '')) def test_macro_embed_video_gone(self):
