vvzvlad
f13d1507ad
Docker Image CI / build (pull_request) Has been cancelled
Issue #13: data["html"]["title"] was embedded into the debug HTML of /post/html without escaping; title never passes through bleach, so a post whose generated title carries markup (e.g. a poll question) was a reflected XSS under ?debug=true. Escape it with html.escape, same as raw_message. Add a regression test with a <script> payload in a poll question. Issue #17: a bare 'pytest' from the repo root failed 22 tests because the config in tests/pytest.ini was not picked up (asyncio_mode lost, .venv collected) and every test module polluted sys.modules['config'] at import time. Move the config to a root pytest.ini with testpaths=tests, and centralize the sys.path bootstrap + config mock in tests/conftest.py, which pytest imports before any test module. Drop the per-module preambles. Closes #13, closes #17 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
18 lines
584 B
Python
18 lines
584 B
Python
"""Shared test bootstrap (issue #17).
|
|
|
|
Ensure the repo root is importable and install the config mock BEFORE any test
|
|
module imports application code. Pytest imports conftest.py before collecting
|
|
test modules, so doing this here (instead of a per-module preamble) makes the
|
|
suite order-independent regardless of collection order or invocation directory.
|
|
"""
|
|
import os
|
|
import sys
|
|
|
|
ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
|
|
if ROOT not in sys.path:
|
|
sys.path.insert(0, ROOT)
|
|
|
|
import tests.mock_config as _mock_config
|
|
|
|
sys.modules['config'] = _mock_config
|