6f01cd6 · unity8 · git.iko.soy

git.iko.soy/unity8

Sanitize template/components contents

commit6f01cd63e7179e05a981e7866a912dc478a74a94 authorAlbert Astals Cid <albert.astals@canonical.com> dateThu 21 Jan 2016, 23:33 (11 years ago) parent610220f

3 files changed+43−21

compare with xenial

unifiedsplit

plugins/Dash/CardCreator.js+18 tests/plugins/Dash/cardcreator/10.tst+2 tests/plugins/Dash/cardcreatortest.cpp+23−21

plugins/Dash/CardCreator.js+18

@@ -373,9 +373,27 @@ var kAudioProgressBarCode = 'CardAudioProgress { \n\

373373 color: %3; \n\

374374 }';

375375

376+function evil_param(object) {

377+ for (var x in object) {

378+ if (typeof object[x] === "object" && evil_param(object[x]))

379+ return true;

380+

381+ if (typeof object[x] === "string" && object[x].match(/"(?:[^"\\]|\\.)*"/) != null)

382+ return true;

383+ }

384+

385+ return false;

386+}

387+

376388function cardString(template, components) {

377389 var code;

378390

391+ if (evil_param(template))

392+ return "";

393+

394+ if (evil_param(components))

395+ return "";

396+

379397 var templateInteractive = (template == null ? true : (template["non-interactive"] !== undefined ? !template["non-interactive"] : true)) ? "true" : "false";

380398

381399 code = 'AbstractButton { \n\

tests/plugins/Dash/cardcreator/10.tstnew file+2

@@ -0,0 +1,2 @@

1+template: {"card-background":{"elements":["#E9E9E9"],"type":"color"},"card-layout":"vertical","card-size":"medium","category-layout":"grid","collapsed-rows":2, "card-background": { "type": "color", "elements": [ "\" : \"\";} Item { } function moo() { return true ? \"" ] } }

2+components: {"art":{"aspect-ratio":1},"background":{"field":"background"},"mascot":{"field":"icon"},"subtitle":{"field":"author"},"title":{"field":"title"},"attributes":{}}

tests/plugins/Dash/cardcreatortest.cpp+23−21

@@ -63,7 +63,7 @@ private Q_SLOTS:

6363

6464 QVERIFY(lines[0].startsWith(templateString));

6565 QVERIFY(lines[1].startsWith(componentsString));

66− QVERIFY(lines[2].startsWith(resultString));

66+

6767 const QString templateJSON = lines[0].mid(templateString.length());

6868 const QString componentsJSON = lines[1].mid(componentsString.length());

6969 const QString resultFileName = lines[2].mid(resultString.length());

@@ -71,30 +71,32 @@ private Q_SLOTS:

7171 QVariant cardStringResult;

7272 QMetaObject::invokeMethod(view->rootObject(), "cardString", Q_RETURN_ARG(QVariant, cardStringResult), Q_ARG(QVariant, templateJSON), Q_ARG(QVariant, componentsJSON));

7373

74− QFile testResultFile(testDirPath + resultFileName);

75− QVERIFY(testResultFile.open(QIODevice::ReadOnly));

76− QTextStream ts2(&testResultFile);

77−

78− // Record failed results to /tmp

79− const QString executedResult = cardStringResult.toString();

80− QTemporaryFile tmpFile(QDir::tempPath() + QDir::separator() + "testCardCreatorFailedResultXXXXXX");

81− tmpFile.open();

82− tmpFile.setAutoRemove(false);

83− tmpFile.write(executedResult.toUtf8().constData());

84−

85− // Line by line comparison

86− const QStringList expectedLines = ts2.readAll().trimmed().replace(QRegExp("\n\\s*\n"),"\n").split("\n");

87− const QStringList cardStringResultLines = cardStringResult.toString().trimmed().replace(QRegExp("\n\\s*\n"),"\n").split("\n");

88− for (int i = 0; i < expectedLines.size(); ++i) {

89− QCOMPARE(cardStringResultLines[i].simplified(), expectedLines[i].simplified());

74+ if (!resultFileName.isEmpty()) {

75+ QFile testResultFile(testDirPath + resultFileName);

76+ QVERIFY(testResultFile.open(QIODevice::ReadOnly));

77+ QTextStream ts2(&testResultFile);

78+

79+ // Record failed results to /tmp

80+ const QString executedResult = cardStringResult.toString();

81+ QTemporaryFile tmpFile(QDir::tempPath() + QDir::separator() + "testCardCreatorFailedResultXXXXXX");

82+ tmpFile.open();

83+ tmpFile.setAutoRemove(false);

84+ tmpFile.write(executedResult.toUtf8().constData());

85+

86+ // Line by line comparison

87+ const QStringList expectedLines = ts2.readAll().trimmed().replace(QRegExp("\n\\s*\n"),"\n").split("\n");

88+ const QStringList cardStringResultLines = cardStringResult.toString().trimmed().replace(QRegExp("\n\\s*\n"),"\n").split("\n");

89+ for (int i = 0; i < expectedLines.size(); ++i) {

90+ QCOMPARE(cardStringResultLines[i].simplified(), expectedLines[i].simplified());

91+ }

92+

93+ // Remove the result if it passed

94+ tmpFile.setAutoRemove(true);

9095 }

9196

92− // Remove the result if it passed

93− tmpFile.setAutoRemove(true);

94−

9597 QVariant createCardComponentResult;

9698 QMetaObject::invokeMethod(view->rootObject(), "createCardComponent", Q_RETURN_ARG(QVariant, createCardComponentResult), Q_ARG(QVariant, templateJSON), Q_ARG(QVariant, componentsJSON));

97− QVERIFY(createCardComponentResult.toBool());

99+ QCOMPARE(createCardComponentResult.toBool(), !resultFileName.isEmpty());

98100 }

99101 }

100102