Docker/mealie
Docker/mealie
1
0
Fork 0
mirror of https://github.com/mealie-recipes/mealie.git synced 2025-08-05 21:45:25 +02:00
Code Issues Releases Activity

fix: Patch XSS Vulnerability (#5754)

Browse source
This commit is contained in:
Michael Genson 2025-07-19 20:45:33 -05:00 • committed by GitHub
parent 6274a3dd39
commit 7d1c5ad14b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 61 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

28
tests/integration_tests/test_spa.py
View file

@ -2,7 +2,8 @@ import pytest
from bs4 import BeautifulSoup
from mealie.routes import spa
from mealie.schema.recipe.recipe import Recipe
from mealie.schema.recipe.recipe import Recipe, RecipeSettings
from mealie.schema.recipe.recipe_notes import RecipeNote
from mealie.schema.recipe.recipe_share_token import RecipeShareTokenSave
from tests import data as test_data
from tests.utils.factories import random_string
@ -189,3 +190,28 @@ async def test_spa_service_shared_recipe_with_meta_invalid_data(unique_user: Tes
response = await spa.serve_shared_recipe_with_meta(group.slug, random_string(), session=unique_user.repos.session)
assert response.status_code == 404
@pytest.mark.parametrize(
"malicious_content, malicious_strings",
[
("<script>alert('XSS');</script>", ["<script>", "alert('XSS')"]),
("<img src=x onerror=alert('XSS')>", ["<img", "onerror=alert('XSS')"]),
("<div onmouseover=alert('XSS')>Hover me</div>", ["<div", "onmouseover=alert('XSS')"]),
("<a href='javascript:alert(\"XSS\")'>Click me</a>", ["<a", 'javascript:alert("XSS")']),
],
)
def test_spa_escapes_malicious_recipe_data(unique_user: TestUser, malicious_content: str, malicious_strings: list[str]):
recipe = Recipe(
user_id=unique_user.user_id,
group_id=unique_user.group_id,
name=malicious_content,
description=malicious_content,
image=malicious_content,
notes=[RecipeNote(title=malicious_content, text=malicious_content)],
settings=RecipeSettings(),
)
response = spa.content_with_meta(unique_user.group_id, recipe)
for string in malicious_strings:
assert string not in response