sharix-open-landing/tests.py

from django.test import SimpleTestCase

from landing.admin_rich_text import LandingPageAdminForm
from landing.models import LandingPage
from landing.rich_text import render_rich_html, sanitize_rich_html


class RichTextSanitizerTests(SimpleTestCase):
    def test_historical_html_keeps_supported_rich_content(self):
        source = (
            '<h2>Heading</h2><p style="text-align:center;color:red">Text</p>'
            '<ul><li>One</li></ul>'
            '<a href="https://example.org">Link</a>'
            '<img src="/media/example.png" alt="Example" width="320">'
        )
        cleaned = sanitize_rich_html(source)
        self.assertIn('<h2>Heading</h2>', cleaned)
        self.assertIn('<ul><li>One</li></ul>', cleaned)
        self.assertIn('href="https://example.org"', cleaned)
        self.assertIn('src="/media/example.png"', cleaned)
        self.assertIn('text-align:center', cleaned)
        self.assertNotIn('color:', cleaned)

    def test_xss_payloads_are_removed_server_side(self):
        source = (
            '<script>alert(1)</script>'
            '<img src="javascript:alert(1)" onerror="alert(2)">'
            '<a href="javascript:alert(3)">bad</a>'
            '<p onclick="alert(4)">safe text</p>'
        )
        cleaned = sanitize_rich_html(source)
        lowered = cleaned.lower()
        self.assertNotIn('<script', lowered)
        self.assertNotIn('javascript:', lowered)
        self.assertNotIn('onerror', lowered)
        self.assertNotIn('onclick', lowered)
        self.assertIn('safe text', cleaned)

    def test_rendered_content_is_sanitized_and_safe(self):
        rendered = render_rich_html('<strong>ok</strong><script>bad()</script>')
        self.assertEqual(str(rendered), '<strong>ok</strong>')
        self.assertTrue(hasattr(rendered, '__html__'))

    def test_model_save_path_sanitizes_without_requiring_editor_field_type(self):
        page = LandingPage(title='Historical', slug='historical', content='<p>ok</p><script>bad()</script>')
        page.clean()
        self.assertEqual(page.content, '<p>ok</p>')
        self.assertEqual(LandingPage._meta.get_field('content').get_internal_type(), 'TextField')


class RichTextEditorWidgetTests(SimpleTestCase):
    def test_admin_uses_widget_without_editor_specific_model_field(self):
        form = LandingPageAdminForm()
        self.assertEqual(form.fields["content"].widget.__class__.__name__, "TinyMCE")
        self.assertEqual(LandingPage._meta.get_field("content").get_internal_type(), "TextField")