vvzvlad
f13d1507ad
Docker Image CI / build (pull_request) Has been cancelled
Issue #13: data["html"]["title"] was embedded into the debug HTML of /post/html without escaping; title never passes through bleach, so a post whose generated title carries markup (e.g. a poll question) was a reflected XSS under ?debug=true. Escape it with html.escape, same as raw_message. Add a regression test with a <script> payload in a poll question. Issue #17: a bare 'pytest' from the repo root failed 22 tests because the config in tests/pytest.ini was not picked up (asyncio_mode lost, .venv collected) and every test module polluted sys.modules['config'] at import time. Move the config to a root pytest.ini with testpaths=tests, and centralize the sys.path bootstrap + config mock in tests/conftest.py, which pytest imports before any test module. Drop the per-module preambles. Closes #13, closes #17 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
10 lines
355 B
INI
10 lines
355 B
INI
[pytest]
|
|
testpaths = tests
|
|
addopts = -ra
|
|
# The stage-1 anti-hang tests are async; run them without per-test event loops
|
|
# being set up by hand. (The tests also carry @pytest.mark.asyncio explicitly, so
|
|
# they work in strict mode too — but auto keeps the plugin's requirement obvious.)
|
|
asyncio_mode = auto
|
|
filterwarnings =
|
|
ignore::DeprecationWarning
|