<commit_before># coding=utf-8
from __future__ import unicode_literals

import mock
from ...helpers import LoggedInApplicationTest
from dmapiclient import HTTPError
import urllib


class TestXSS(LoggedInApplicationTest):
    @mock.patch('app.main.views.services.data_api_client')
    def test_service_not_found_flash_message_injection(self, data_api_client):
        """
        Asserts that raw HTML in a bad service ID cannot be injected into a flash message.
        """
        # impl copied from test_services.TestServiceView#test_redirect_with_flash_for_api_client_404
        api_response = mock.Mock()
        api_response.status_code = 404
        data_api_client.get_service.side_effect = HTTPError(api_response)

        evil_service_id = "1<img src=a onerror=alert(1)>"
        response1 = self.client.get('/admin/services/' + urllib.quote(evil_service_id))
        response2 = self.client.get(response1.location)
        self.assertNotIn(
            b'Error trying to retrieve service with ID: ' + evil_service_id.encode('utf8'),
            response2.data)


    @mock.patch('app.main.views.services.data_api_client')
    def test_brief_not_found_flash_message_injection(self, data_api_client):
        """
        Asserts that raw HTML in a bad brief ID cannot be injected into a flash message.
        """
        # impl copied from test_buyers.TestBuyersView#test_should_display_a_useful_message_if_no_brief_found
        data_api_client.get_brief.return_value = None
        evil_brief_id = "1<img src=a onerror=alert(1)>"
        response = self.client.get('admin/buyers?brief_id=' + urllib.quote(evil_brief_id))
        self.assertNotIn(
            b'There are no opportunities with ID ' + evil_brief_id.encode('utf8'),
            response.data)<commit_msg>Too many blank lines<commit_after># coding=utf-8
from __future__ import unicode_literals

import mock
from ...helpers import LoggedInApplicationTest
from dmapiclient import HTTPError
import urllib


class TestXSS(LoggedInApplicationTest):
    @mock.patch('app.main.views.services.data_api_client')
    def test_service_not_found_flash_message_injection(self, data_api_client):
        """
        Asserts that raw HTML in a bad service ID cannot be injected into a flash message.
        """
        # impl copied from test_services.TestServiceView#test_redirect_with_flash_for_api_client_404
        api_response = mock.Mock()
        api_response.status_code = 404
        data_api_client.get_service.side_effect = HTTPError(api_response)

        evil_service_id = "1<img src=a onerror=alert(1)>"
        response1 = self.client.get('/admin/services/' + urllib.quote(evil_service_id))
        response2 = self.client.get(response1.location)
        self.assertNotIn(
            b'Error trying to retrieve service with ID: ' + evil_service_id.encode('utf8'),
            response2.data)

    @mock.patch('app.main.views.services.data_api_client')
    def test_brief_not_found_flash_message_injection(self, data_api_client):
        """
        Asserts that raw HTML in a bad brief ID cannot be injected into a flash message.
        """
        # impl copied from test_buyers.TestBuyersView#test_should_display_a_useful_message_if_no_brief_found
        data_api_client.get_brief.return_value = None
        evil_brief_id = "1<img src=a onerror=alert(1)>"
        response = self.client.get('admin/buyers?brief_id=' + urllib.quote(evil_brief_id))
        self.assertNotIn(
            b'There are no opportunities with ID ' + evil_brief_id.encode('utf8'),
            response.data)
{'fraction_non_alphanumeric': 0.08585858585858586, 'fraction_numerical': 0.009539842873176206, 'mean_word_length': 3.4842767295597485, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1189513', 'n_tokens_mistral': 1109, 'n_tokens_neox': 1082, 'n_words': 228}