Repository: freedomofpress/securedrop

Issue:
Data in the dev container should contain markup to help prevent regressions with escaping
## Description

The data that is loaded into the dev container should contain messages / replies with markup to ensure that both web interfaces and the client do not regress. We have tests and various measures in place to prevent this, but if we make the dev data include strings like `<strong>this text should not be bold</strong>`, then regression will be more noticeable during development and manual testing.


Discussion:
Hi, I'd like to help, but I'm not exactly clear about what needs to be done. Can someone elaborate, please?

Thanks for such a great product, team!
hey @RJ722: the place you want to edit is the [create-dev-data.py](https://github.com/freedomofpress/securedrop/blob/develop/securedrop/create-dev-data.py) script. The two places in that script you'll want to edit are the strings used:

* for messages here: https://github.com/freedomofpress/securedrop/blob/develop/securedrop/create-dev-data.py#L82
* and for replies here: https://github.com/freedomofpress/securedrop/blob/develop/securedrop/create-dev-data.py#L94

The task here is to replace those strings with strings that better test our input validation. 

One implementation would be to replace those two strings with a call to two new functions (maybe called `generate_test_message()` and `generate_test_reply()`) that e.g. return the existing string on the first call, and on the second call it returns the suggested string from the issue containing HTML markup like `<strong>this text should not be bold</strong>`. There are of course other perfectly reasonable ways to do this, a place you might want to look for inspiration is [this list of good strings](https://github.com/minimaxir/big-list-of-naughty-strings) for finding issues with input validation. 
I'm pretty interested in start contributing to SecureDrop. This seems like something I can take on. @RJ722 Are you still on it?
Hello @redshiftzero and @f-lai, I'm very sorry for replying so late. The notification got buried.

@redshiftzero thanks for the helpful message, got it. I shall raise a PR today.

@f-lai yes, I would like to continue with this.

Resolving patch:
diff --git a/securedrop/create-dev-data.py b/securedrop/create-dev-data.py
--- a/securedrop/create-dev-data.py
+++ b/securedrop/create-dev-data.py
@@ -4,6 +4,7 @@
 import datetime
 import os
 import argparse
+from itertools import cycle
 
 from flask import current_app
 from sqlalchemy.exc import IntegrityError
@@ -15,6 +16,18 @@
 from db import db
 from models import Journalist, Reply, Source, Submission
 
+submissions = cycle([
+    'This is a test submission without markup!',
+    'This is a test submission with markup and characters such as \, \\, \', \" and ". ' +  # noqa: W605, E501
+    '<strong>This text should not be bold</strong>!'
+])
+
+replies = cycle([
+    'This is a test reply without markup!',
+    'This is a test reply with markup and characters such as \, \\, \', \" and ". ' +  # noqa: W605, E501
+    '<strong>This text should not be bold</strong>!'
+])
+
 
 def main(staging=False):
     app = journalist_app.create_app(config)
@@ -79,7 +92,7 @@ def create_source_and_submissions(num_submissions=2, num_replies=2):
             source.filesystem_id,
             source.interaction_count,
             source.journalist_filename,
-            'test submission!'
+            next(submissions)
         )
         source.last_updated = datetime.datetime.utcnow()
         submission = Submission(source, fpath)
@@ -91,7 +104,7 @@ def create_source_and_submissions(num_submissions=2, num_replies=2):
         fname = "{}-{}-reply.gpg".format(source.interaction_count,
                                          source.journalist_filename)
         current_app.crypto_util.encrypt(
-            'this is a test reply!',
+            next(replies),
             [current_app.crypto_util.getkey(source.filesystem_id),
              config.JOURNALIST_KEY],
             current_app.storage.path(source.filesystem_id, fname))


Test patch: