Module Expr Str ImportFrom alias ImportFrom alias FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Assign NameStore ListLoad Str Assign NameStore ListLoad Str Expr Call NameLoad Str Call NameLoad Str Expr Call NameLoad Str Call NameLoad Str keyword NameLoad keyword NameLoad Expr Call NameLoad Str Call NameLoad Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Assign NameStore ListLoad Str Assign NameStore Dict Str Lambda arguments args NameParam NameParam defaults BoolOpAnd CompareEq NameLoad Str CompareEq NameLoad Str Expr Call NameLoad Str Call NameLoad Str keyword NameLoad keyword NameLoad Expr Call NameLoad Str Call NameLoad Str keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str Expr Call NameLoad Str Call NameLoad Str Expr Call NameLoad Str Call NameLoad Str decorator_list FunctionDef arguments args defaults body Expr Str Assign NameStore Str Expr Call NameLoad Str Call NameLoad NameLoad keyword NameLoad Assign NameStore Str Expr Call NameLoad Str Call NameLoad NameLoad keyword NameLoad decorator_list FunctionDef arguments args defaults body Expr Str Assign NameStore Str Assign NameStore Str Expr Call NameLoad NameLoad Call NameLoad NameLoad decorator_list FunctionDef arguments args defaults body Expr Str Assign NameStore ListLoad Str Assign NameStore Dict Str ListLoad Str Assign NameStore Str Assign NameStore Str Expr Call NameLoad NameLoad Call NameLoad NameLoad keyword NameLoad keyword NameLoad Assign NameStore Str Expr Call NameLoad NameLoad Call NameLoad NameLoad keyword NameLoad keyword NameLoad decorator_list FunctionDef arguments args defaults body Expr Call NameLoad Str Call NameLoad Str decorator_list
N/A N/A More advanced security tests nose.tools eq_ bleach clean test_nested_script_tag N/A N/A N/A N/A N/A N/A eq_ &lt;&lt;script&gt;script&gt;evil()&lt;&lt;/script&gt;/script&gt; N/A clean <<script>script>evil()<</script>/script> N/A N/A eq_ &lt;&lt;x&gt;script&gt;evil()&lt;&lt;/x&gt;/script&gt; N/A clean <<x>script>evil()<</x>/script> N/A test_nested_script_tag_r N/A N/A N/A N/A N/A N/A eq_ &lt;script&lt;script&gt;&gt;evil()&lt;/script&lt;&gt;&gt; N/A clean <script<script>>evil()</script</script>> N/A test_invalid_attr N/A N/A N/A N/A N/A IMG N/A img N/A IMG_ATTR N/A src N/A N/A eq_ <a href="test">test</a> N/A clean <a onclick="evil" href="test">test</a> N/A N/A eq_ <img src="test"> N/A clean <img onclick="evil" src="test" /> tags IMG attributes IMG_ATTR N/A N/A eq_ <img src="test"> N/A clean <img href="invalid" src="test" /> tags IMG attributes IMG_ATTR N/A test_unquoted_attr N/A N/A N/A N/A N/A N/A eq_ <abbr title="mytitle">myabbr</abbr> N/A clean <abbr title=mytitle>myabbr</abbr> N/A test_unquoted_event_handler N/A N/A N/A N/A N/A N/A eq_ <a href="http://xx.com">xx.com</a> N/A clean <a href="http://xx.com" onclick=foo()>xx.com</a> N/A test_invalid_attr_value N/A N/A N/A N/A N/A N/A eq_ &lt;img src="javascript:alert('XSS');"&gt; N/A clean <img src="javascript:alert('XSS');"> N/A test_invalid_href_attr N/A N/A N/A N/A N/A N/A eq_ <a>xss</a> N/A clean <a href="javascript:alert('XSS')">xss</a> N/A test_invalid_filter_attr N/A N/A N/A N/A N/A IMG N/A img N/A IMG_ATTR N/A img N/A N/A N/A n v N/A N/A N/A n src N/A v http://example.com/ N/A N/A eq_ <img src="http://example.com/"> N/A clean <img onclick="evil" src="http://example.com/" /> tags IMG attributes IMG_ATTR N/A N/A eq_ <img> N/A clean <img onclick="evil" src="http://badhost.com/" /> tags IMG attributes IMG_ATTR N/A test_invalid_tag_char N/A N/A N/A N/A N/A N/A eq_ &lt;script xss="" src="http://xx.com/xss.js"&gt;&lt;/script&gt; N/A clean <script/xss src="http://xx.com/xss.js"></script> N/A N/A eq_ &lt;script src="http://xx.com/xss.js"&gt;&lt;/script&gt; N/A clean <script/src="http://xx.com/xss.js"></script> N/A test_unclosed_tag N/A N/A N/A N/A N/A N/A eq_ &lt;script src="http://xx.com/xss.js&amp;lt;b"&gt; N/A clean <script src=http://xx.com/xss.js<b> N/A N/A eq_ &lt;script src="http://xx.com/xss.js" &lt;b=""&gt; N/A clean <script src="http://xx.com/xss.js"<b> N/A N/A eq_ &lt;script src="http://xx.com/xss.js" &lt;b=""&gt; N/A clean <script src="http://xx.com/xss.js" <b> N/A test_strip N/A N/A N/A N/A N/A Using strip=True shouldn't result in malicious content. N/A s <scri<script>pt>alert(1)</scr</script>ipt> N/A N/A eq_ pt&gt;alert(1)ipt&gt; N/A clean s strip True N/A s <scri<scri<script>pt>pt>alert(1)</script> N/A N/A eq_ pt&gt;pt&gt;alert(1) N/A clean s strip True N/A test_nasty N/A N/A N/A N/A N/A Nested, broken up, multiple tags, are still foiled! N/A test <scr<script></script>ipt type="text/javascript">alert("foo");</<script></script>script<del></del>> N/A expect &lt;scr&lt;script&gt;&lt;/script&gt;ipt type="text/javascript"&gt;alert("foo");&lt;/script&gt;script&lt;del&gt;&lt;/del&gt;&gt; N/A N/A eq_ expect N/A clean test N/A test_poster_attribute N/A N/A N/A N/A N/A Poster attributes should not allow javascript. N/A tags N/A video N/A attrs N/A video N/A poster N/A test <video poster="javascript:alert(1)"></video> N/A expect <video></video> N/A N/A eq_ expect N/A clean test tags tags attributes attrs N/A ok <video poster="/foo.png"></video> N/A N/A eq_ ok N/A clean ok tags tags attributes attrs N/A test_feed_protocol N/A N/A N/A N/A N/A N/A eq_ <a>foo</a> N/A clean <a href="feed:file:///tmp/foo">foo</a> N/A