#NEWLINE# def test_security_check( self , password = 'password' ) : #NEWLINE# #INDENT# logout_url = reverse ( 'logout' ) #NEWLINE# for bad_url in ( 'http://example.com' , 'http:///example.com' , 'https://example.com' , 'ftp://exampel.com' , '///example.com' , '//example.com' , 'javascript:alert("XSS")' ) : #NEWLINE# #INDENT# nasty_url = ( '%(url)s?%(next)s=%(bad_url)s' % { #NEWLINE# #INDENT# 'url' : logout_url , #NEWLINE# 'next' : REDIRECT_FIELD_NAME , #NEWLINE# 'bad_url' : urlquote ( bad_url ) , #NEWLINE# #UNINDENT# } ) #NEWLINE# self . login ( ) #NEWLINE# response = self . client . get ( nasty_url ) #NEWLINE# self . assertEqual ( response . status_code , 302 ) #NEWLINE# self . assertFalse ( ( bad_url in response . url ) , ( '%s should be blocked' % bad_url ) ) #NEWLINE# self . confirm_logged_out ( ) #NEWLINE# #UNINDENT# for good_url in ( '/view/?param=http://example.com' , '/view/?param=https://example.com' , '/view?param=ftp://exampel.com' , 'view/?param=//example.com' , 'https://testserver/' , 'HTTPS://testserver/' , '//testserver/' , '/url%20with%20spaces/' ) : #NEWLINE# #INDENT# safe_url = ( '%(url)s?%(next)s=%(good_url)s' % { #NEWLINE# #INDENT# 'url' : logout_url , #NEWLINE# 'next' : REDIRECT_FIELD_NAME , #NEWLINE# 'good_url' : urlquote ( good_url ) , #NEWLINE# #UNINDENT# } ) #NEWLINE# self . login ( ) #NEWLINE# response = self . client . get ( safe_url ) #NEWLINE# self . assertEqual ( response . status_code , 302 ) #NEWLINE# self . assertTrue ( ( good_url in response . url ) , ( '%s should be allowed' % good_url ) ) #NEWLINE# self . confirm_logged_out ( )