import os from datetime import datetime from django.test import SimpleTestCase from django.utils.functional import lazystr from django.utils.html import ( conditional_escape, escape, escapejs, format_html, html_safe, linebreaks, smart_urlquote, strip_spaces_between_tags, strip_tags, ) from django.utils.safestring import mark_safe class TestUtilsHtml(SimpleTestCase): def check_output(self, function, value, output=None): """ function(value) equals output. If output is None, function(value) equals value. """ if output is None: output = value self.assertEqual(function(value), output) def test_escape(self): items = ( ('&', '&'), ('<', '<'), ('>', '>'), ('"', '"'), ("'", '''), ) # Substitution patterns for testing the above items. patterns = ("%s", "asdf%sfdsa", "%s1", "1%sb") for value, output in items: with self.subTest(value=value, output=output): for pattern in patterns: with self.subTest(value=value, output=output, pattern=pattern): self.check_output(escape, pattern % value, pattern % output) self.check_output(escape, lazystr(pattern % value), pattern % output) # Check repeated values. self.check_output(escape, value * 2, output * 2) # Verify it doesn't double replace &. self.check_output(escape, '<&', '<&') def test_format_html(self): self.assertEqual( format_html( "{} {} {third} {fourth}", "< Dangerous >", mark_safe("safe"), third="< dangerous again", fourth=mark_safe("safe again"), ), "< Dangerous > safe < dangerous again safe again" ) def test_linebreaks(self): items = ( ("para1\n\npara2\r\rpara3", "
para1
\n\npara2
\n\npara3
"), ("para1\nsub1\rsub2\n\npara2", "para1
sub1
sub2
para2
"), ("para1\r\n\r\npara2\rsub1\r\rpara4", "para1
\n\npara2
sub1
para4
"), ("para1\tmore\n\npara2", "para1\tmore
\n\npara2
"), ) for value, output in items: with self.subTest(value=value, output=output): self.check_output(linebreaks, value, output) self.check_output(linebreaks, lazystr(value), output) def test_strip_tags(self): items = ( ('See: 'é is an apostrophe followed by e acute
', 'See: 'é is an apostrophe followed by e acute'), ('b
c', 'abc'), ('ab
c', 'abc'), ('dhello
\nworld
', 'hello
world
'), ('\n\t
\n\n', '\n\n'), ) for value, output in items: with self.subTest(value=value, output=output): self.check_output(strip_spaces_between_tags, value, output) self.check_output(strip_spaces_between_tags, lazystr(value), output) def test_escapejs(self): items = ( ('"double quotes" and \'single quotes\'', '\\u0022double quotes\\u0022 and \\u0027single quotes\\u0027'), (r'\ : backslashes, too', '\\u005C : backslashes, too'), ( 'and lots of whitespace: \r\n\t\v\f\b', 'and lots of whitespace: \\u000D\\u000A\\u0009\\u000B\\u000C\\u0008' ), (r'', '\\u003Cscript\\u003Eand this\\u003C/script\\u003E'), ( 'paragraph separator:\u2029and line separator:\u2028', 'paragraph separator:\\u2029and line separator:\\u2028' ), ('`', '\\u0060'), ) for value, output in items: with self.subTest(value=value, output=output): self.check_output(escapejs, value, output) self.check_output(escapejs, lazystr(value), output) def test_smart_urlquote(self): items = ( ('http://öäü.com/', 'http://xn--4ca9at.com/'), ('http://öäü.com/öäü/', 'http://xn--4ca9at.com/%C3%B6%C3%A4%C3%BC/'), # Everything unsafe is quoted, !*'();:@&=+$,/?#[]~ is considered # safe as per RFC. ('http://example.com/path/öäü/', 'http://example.com/path/%C3%B6%C3%A4%C3%BC/'), ('http://example.com/%C3%B6/ä/', 'http://example.com/%C3%B6/%C3%A4/'), ('http://example.com/?x=1&y=2+3&z=', 'http://example.com/?x=1&y=2+3&z='), ('http://example.com/?x=<>"\'', 'http://example.com/?x=%3C%3E%22%27'), ('http://example.com/?q=http://example.com/?x=1%26q=django', 'http://example.com/?q=http%3A%2F%2Fexample.com%2F%3Fx%3D1%26q%3Ddjango'), ('http://example.com/?q=http%3A%2F%2Fexample.com%2F%3Fx%3D1%26q%3Ddjango', 'http://example.com/?q=http%3A%2F%2Fexample.com%2F%3Fx%3D1%26q%3Ddjango'), ) # IDNs are properly quoted for value, output in items: with self.subTest(value=value, output=output): self.assertEqual(smart_urlquote(value), output) def test_conditional_escape(self): s = '