Files
zulip/zerver/webhooks/dropbox/tests.py
Anders Kaseorg 87f7874a79 CVE-2020-12759: Fix reflected XSS vulnerability in Dropbox webhook.
Also check the challenge argument’s presence before using it.

Signed-off-by: Anders Kaseorg <anders@zulip.com>
2020-06-16 22:46:16 -07:00

33 lines
1.4 KiB
Python

from zerver.lib.test_classes import WebhookTestCase
from zerver.lib.users import get_api_key
class DropboxHookTests(WebhookTestCase):
STREAM_NAME = 'test'
URL_TEMPLATE = "/api/v1/external/dropbox?&api_key={api_key}&stream={stream}"
FIXTURE_DIR_NAME = 'dropbox'
def test_file_updated(self) -> None:
expected_topic = "Dropbox"
expected_message = "File has been updated on Dropbox!"
self.send_and_test_stream_message('file_updated', expected_topic, expected_message,
content_type="application/x-www-form-urlencoded")
def get_body(self, fixture_name: str) -> str:
return self.webhook_fixture_data("dropbox", fixture_name, file_type="json")
def test_verification_request(self) -> None:
self.subscribe(self.test_user, self.STREAM_NAME)
get_params = {'stream_name': self.STREAM_NAME,
'api_key': get_api_key(self.test_user)}
result = self.client_get(self.url, get_params)
self.assert_json_error(result, "Missing 'challenge' argument", 400)
get_params['challenge'] = '9B2SVL4orbt5DxLMqJHI6pOTipTqingt2YFMIO0g06E'
result = self.client_get(self.url, get_params)
self.assertEqual(result.status_code, 200)
self.assertEqual(result["Content-Type"], "text/plain; charset=UTF-8")
self.assert_in_response('9B2SVL4orbt5DxLMqJHI6pOTipTqingt2YFMIO0g06E', result)