Securedrop: Data in the dev container should contain markup to help prevent regressions with escaping

Created on 18 Mar 2019 · 4Comments · Source: freedomofpress/securedrop

Description

The data that is loaded into the dev container should contain messages / replies with markup to ensure that both web interfaces and the client do not regress. We have tests and various measures in place to prevent this, but if we make the dev data include strings like <strong>this text should not be bold</strong>, then regression will be more noticeable during development and manual testing.

good first issue help wanted

Source

heartsucker

All 4 comments

Hi, I'd like to help, but I'm not exactly clear about what needs to be done. Can someone elaborate, please?

Thanks for such a great product, team!

RJ722 on 12 Jun 2019

🎉1

hey @RJ722: the place you want to edit is the create-dev-data.py script. The two places in that script you'll want to edit are the strings used:

for messages here: https://github.com/freedomofpress/securedrop/blob/develop/securedrop/create-dev-data.py#L82
and for replies here: https://github.com/freedomofpress/securedrop/blob/develop/securedrop/create-dev-data.py#L94

The task here is to replace those strings with strings that better test our input validation.

One implementation would be to replace those two strings with a call to two new functions (maybe called generate_test_message() and generate_test_reply()) that e.g. return the existing string on the first call, and on the second call it returns the suggested string from the issue containing HTML markup like <strong>this text should not be bold</strong>. There are of course other perfectly reasonable ways to do this, a place you might want to look for inspiration is this list of good strings for finding issues with input validation.