-
Notifications
You must be signed in to change notification settings - Fork 369
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Transient test failures #5834
Comments
====================================================================== FAIL: test_edit (ietf.secr.sreq.tests.SessionRequestTestCase.test_edit)Traceback (most recent call last): |
I just hit the above as well. |
======================================================================
|
@larseggert - Makes me wonder - Do we have an open path already (and does this make it any worse) for arbitrary HTML injection through the user provided name? Maybe this needs bleaching before being marked clean on the way out? |
Possibly. The other way to fix this is of course to not mark it safe and instead compare against the escaped name in the test. (We would need to temporarily hardwire the factory to that name to find all the tests that are broken in the same way.) |
@rjsparks Which fix do you prefer? |
Better not to mark it safe unless we actually mean to allow literal HTML in the fields - I'm fairly sure we want Django to do the escaping here and we should update the tests to expect that. |
Ok. Will update the PR at the code sprint |
Done |
* fix: Add `mark_safe` to `person_link` to prevent HTML escaping Fixes part of #5834, namely #5834 (comment) * fix: Fix tests instead of marking name safe
Here is another:
|
Same error as above in this run: https://github.com/ietf-tools/datatracker/actions/runs/5902988978/job/16012002249
|
|
(also randomly affects other tests using the same helper method) |
|
This is resolved by #7198 |
We have some transient test failures creeping back in. This issue will gather them.
The text was updated successfully, but these errors were encountered: