gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42048: Add a Cypress test 

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2026-03-12 12:42:21 +01:00 committed by Lucas Gass
parent 8dd51fb212
commit 4d78fc4175
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
t/cypress/integration/KohaTable/KohaTable_spec.ts
View File

@ -480,6 +480,50 @@ describe("kohaTable (using REST API)", () => {
cy.get("#searchresults .browse .filterByLetter:first").click();
});
});
it("Prevent XSS when using description", () => {
cy.task("buildSampleObjects", {
object: "patron",
count: RESTdefaultPageSize,
values: {},
}).then(patrons => {
// Needs more properties to not explode
// account_balace: balance_str.escapeHtml(...).format_price is not a function
patrons = patrons.map(p => ({ ...p, account_balance: 0 }));
cy.intercept("GET", "/api/v1/patrons*", {
statusCode: 200,
body: patrons,
headers: {
"X-Base-Total-Count": baseTotalCount,
"X-Total-Count": baseTotalCount,
},
});
cy.visit("/cgi-bin/koha/members/members-home.pl");
cy.get("#search_patron_filter").type(
"<script>alert('boo');</script>"
);
cy.window().then(win => {
win.categories_map = patrons.reduce((map, p) => {
map[p.category_id.toLowerCase()] = p.category_id;
return map;
}, {});
});
cy.get("form.patron_search_form .branchcode_filter").select(
"CPL"
);
cy.get("form.patron_search_form input[type='submit']").click();
cy.get(`#${table_id}_wrapper .dt-info`).contains(
`Showing 1 to ${RESTdefaultPageSize} of ${baseTotalCount} entries`
);
cy.get("#searchresults .search_description").contains(
"Standard starting with '<script>alert('boo');</script>'"
);
});
});
});
});