Skip to content

Commit

Permalink
add tests
Browse files Browse the repository at this point in the history
  • Loading branch information
gidsg committed Sep 27, 2024
1 parent f257749 commit b70127d
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 1 deletion.
1 change: 0 additions & 1 deletion fsd_utils/locale_selector/set_lang.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,6 @@ def __init__(self, app):
@staticmethod
def select_language(locale):
referrer = request.referrer or "/"
referrer = referrer.replace("\\", "/")
if not urlparse(referrer).netloc and not urlparse(referrer).scheme:
response = make_response(redirect(referrer, 302))

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.
else:
Expand Down
22 changes: 22 additions & 0 deletions tests/test_set_lang.py
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,25 @@ def test_set_lang(flask_test_client):
response_cookie = response.headers.get("Set-Cookie")
assert response_cookie is not None, "No cookie set for language"
assert response_cookie.split(";")[0] == ("language" + "=cy")


def test_set_lang_referrer_ignores_external_referrer(flask_test_client):
mock_app = Mock()
set_lang = LanguageSelector(mock_app)
mock_app.add_url_rule.assert_called_with("/language/<locale>", view_func=ANY)
with flask_test_client.application.test_request_context(
headers={"Referer": "http://example.com/foo"}
):
response = set_lang.select_language("cy")
assert response.location == "/"


def test_set_lang_follows_internal_referrer(flask_test_client):
mock_app = Mock()
set_lang = LanguageSelector(mock_app)
mock_app.add_url_rule.assert_called_with("/language/<locale>", view_func=ANY)
with flask_test_client.application.test_request_context(
headers={"Referer": "localhost/foo"}
):
response = set_lang.select_language("cy")
assert response.location == "localhost/foo"

0 comments on commit b70127d

Please sign in to comment.