Skip to content

Commit a53fcef

Browse files
kiblikkiblik
authored
Quotes (#12226)
1 parent 5bf2349 commit a53fcef

File tree

8 files changed

+88
-23
lines changed

8 files changed

+88
-23
lines changed

‎dojo/templates/notifications/webhooks/subtemplates/base.tpl

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
{% load display_tags %}
2+
{% load as_json %}
23
---
3-
description: "{{ description | default_if_none:'' }}"
4-
title: "{{ title | default_if_none:'' }}"
5-
user: {{ user | default_if_none:'' }}
4+
description: {{ description | as_json_no_html_esc }}
5+
title: {{ title | as_json_no_html_esc }}
6+
user: {{ user | as_json_no_html_esc }}
67
{% if url %}
7-
url_ui: {{ url|full_url }}
8+
url_ui: {{ url | full_url | as_json_no_html_esc }}
89
{% endif %}
910
{% if url_api %}
10-
url_api: {{ url_api|full_url }}
11+
url_api: {{ url_api | full_url | as_json_no_html_esc }}
1112
{% endif %}
1213
{% if system_settings.disclaimer_notifications and system_settings.disclaimer_notifications.strip %}
13-
disclaimer: {{ system_settings.disclaimer_notifications }}
14+
disclaimer: {{ system_settings.disclaimer_notifications | as_json_no_html_esc }}
1415
{% endif %}

‎dojo/templates/notifications/webhooks/subtemplates/engagement.tpl

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{% load display_tags %}
2+
{% load as_json %}
23
{% if product %}
34
{% include 'notifications/webhooks/subtemplates/product.tpl' with product=product %}
45
{% else %}
@@ -7,7 +8,7 @@
78
{% url 'view_engagement' engagement.id as engagement_url_ui %}
89
{% url 'engagement-detail' engagement.id as engagement_url_api %}
910
engagement:
10-
name: {{ engagement.name | default_if_none:'' }}
11+
name: {{ engagement.name | as_json_no_html_esc }}
1112
id: {{ engagement.pk }}
12-
url_ui: {{ engagement_url_ui|full_url }}
13-
url_api: {{ engagement_url_api|full_url }}
13+
url_ui: {{ engagement_url_ui | full_url | as_json_no_html_esc }}
14+
url_api: {{ engagement_url_api | full_url | as_json_no_html_esc }}

‎dojo/templates/notifications/webhooks/subtemplates/findings_list.tpl

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
{% load display_tags %}
2+
{% load as_json %}
23
{% for finding in findings %}
34
{% url 'view_finding' finding.id as finding_url_ui %}
45
{% url 'finding-detail' finding.id as finding_url_api %}
56
- id: {{ finding.pk }}
6-
title: {{ finding.title | default_if_none:'' }}
7-
severity: {{ finding.severity | default_if_none:'' }}
8-
url_ui: {{ finding_url_ui|full_url }}
9-
url_api: {{ finding_url_api|full_url }}
7+
title: {{ finding.title | as_json_no_html_esc }}
8+
severity: {{ finding.severity | as_json_no_html_esc }}
9+
url_ui: {{ finding_url_ui | full_url | as_json_no_html_esc }}
10+
url_api: {{ finding_url_api | full_url | as_json_no_html_esc }}
1011
{% empty %}
1112
[]
1213
{% endfor %}

‎dojo/templates/notifications/webhooks/subtemplates/product.tpl

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{% load display_tags %}
2+
{% load as_json %}
23
{% if product_type %}
34
{% include 'notifications/webhooks/subtemplates/product_type.tpl' with product_type=product_type %}
45
{% else %}
@@ -7,7 +8,7 @@
78
{% url 'view_product' product.id as product_url_ui %}
89
{% url 'product-detail' product.id as product_url_api %}
910
product:
10-
name: {{ product.name | default_if_none:'' }}
11+
name: {{ product.name | as_json_no_html_esc }}
1112
id: {{ product.pk }}
12-
url_ui: {{ product_url_ui|full_url }}
13-
url_api: {{ product_url_api|full_url }}
13+
url_ui: {{ product_url_ui | full_url | as_json_no_html_esc }}
14+
url_api: {{ product_url_api | full_url | as_json_no_html_esc }}

‎dojo/templates/notifications/webhooks/subtemplates/product_type.tpl

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
{% load display_tags %}
2+
{% load as_json %}
23
{% url 'view_product_type' product_type.id as product_type_url_ui %}
34
{% url 'product_type-detail' product_type.id as product_type_url_api %}
45
product_type:
5-
name: {{ product_type.name | default_if_none:'' }}
6+
name: {{ product_type.name | as_json_no_html_esc }}
67
id: {{ product_type.pk }}
7-
url_ui: {{ product_type_url_ui|full_url }}
8-
url_api: {{ product_type_url_api|full_url }}
8+
url_ui: {{ product_type_url_ui | full_url | as_json_no_html_esc }}
9+
url_api: {{ product_type_url_api | full_url | as_json_no_html_esc }}

‎dojo/templates/notifications/webhooks/subtemplates/test.tpl

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{% load display_tags %}
2+
{% load as_json %}
23
{% if engagement %}
34
{% include 'notifications/webhooks/subtemplates/engagement.tpl' with engagement=engagement %}
45
{% else %}
@@ -7,7 +8,7 @@
78
{% url 'view_test' test.id as test_url_ui %}
89
{% url 'test-detail' test.id as test_url_api %}
910
test:
10-
title: {{ test.title | default_if_none:'' }}
11+
title: {{ test.title | as_json_no_html_esc }}
1112
id: {{ test.pk }}
12-
url_ui: {{ test_url_ui|full_url }}
13-
url_api: {{ test_url_api|full_url }}
13+
url_ui: {{ test_url_ui | full_url | as_json_no_html_esc }}
14+
url_api: {{ test_url_api | full_url | as_json_no_html_esc }}

‎dojo/templatetags/as_json.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
11
import json
22

33
from django import template
4+
from django.utils.safestring import mark_safe
45

56
register = template.Library()
67

78

89
@register.filter
910
def as_json(value):
1011
return json.dumps(value)
12+
13+
14+
@register.filter(is_safe=True)
15+
def as_json_no_html_esc(value):
16+
return mark_safe(json.dumps(value))

‎unittests/test_notifications.py

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -756,7 +756,7 @@ def test_events_messages(self, mock):
756756
self.maxDiff = None
757757
self.assertEqual(mock.call_args.kwargs["json"], {
758758
"description": "Event engagement_added has occurred.",
759-
"title": "Engagement created for "notif prod": notif eng",
759+
"title": 'Engagement created for "notif prod": notif eng',
760760
"user": None,
761761
"url_api": f"http://localhost:8080/api/v2/engagements/{eng.pk}/",
762762
"url_ui": f"http://localhost:8080/engagement/{eng.pk}",
@@ -923,3 +923,56 @@ def test_events_messages(self, mock):
923923
"url_ui": "http://localhost:8080/finding/235",
924924
}],
925925
})
926+
927+
with self.subTest("scan_added problematic titles"):
928+
BaseImporter(
929+
environment=Development_Environment.objects.get_or_create(name="Development")[0],
930+
scan_type="ZAP Scan",
931+
).notify_scan_added(
932+
test,
933+
updated_count=4,
934+
new_findings=[
935+
Finding.objects.create(test=test, title="Colon: New Finding", severity="Critical"),
936+
],
937+
findings_mitigated=[
938+
Finding.objects.create(test=test, title="[Brackets] Mitigated Finding", severity="Medium"),
939+
],
940+
findings_reactivated=[
941+
Finding.objects.create(test=test, title='"Quotation1" Reactivated Finding', severity="Low"),
942+
],
943+
findings_untouched=[
944+
Finding.objects.create(test=test, title="'Quotation2' Untouched Finding", severity="Info"),
945+
],
946+
)
947+
self.assertEqual(mock.call_args.kwargs["headers"]["X-DefectDojo-Event"], "scan_added")
948+
self.maxDiff = None
949+
self.assertEqual(mock.call_args.kwargs["json"]["findings"], {
950+
"new": [{
951+
"id": 236,
952+
"title": "Colon: New Finding",
953+
"severity": "Critical",
954+
"url_api": "http://localhost:8080/api/v2/findings/236/",
955+
"url_ui": "http://localhost:8080/finding/236",
956+
}],
957+
"mitigated": [{
958+
"id": 237,
959+
"title": "[Brackets] Mitigated Finding",
960+
"severity": "Medium",
961+
"url_api": "http://localhost:8080/api/v2/findings/237/",
962+
"url_ui": "http://localhost:8080/finding/237",
963+
}],
964+
"reactivated": [{
965+
"id": 238,
966+
"title": '"Quotation1" Reactivated Finding',
967+
"severity": "Low",
968+
"url_api": "http://localhost:8080/api/v2/findings/238/",
969+
"url_ui": "http://localhost:8080/finding/238",
970+
}],
971+
"untouched": [{
972+
"id": 239,
973+
"title": "'Quotation2' Untouched Finding",
974+
"severity": "Info",
975+
"url_api": "http://localhost:8080/api/v2/findings/239/",
976+
"url_ui": "http://localhost:8080/finding/239",
977+
}],
978+
})

0 commit comments

Comments
 (0)