tests: Add test for unescaped values in patch detail page

Add a test to check whether we are escaping values from the Patch model on
the patch detail page.

This test shouldn't be relied upon as proof that we've escaped everything
correctly, but may help catch regressions.

Signed-off-by: Andrew Donnellan <[email protected]>
(backported from df80e69)
Signed-off-by: Daniel Axtens <[email protected]>

Author: daxtens

patchwork/tests/test_detail.py

@@ -66,6 +66,23 @@ def test_series_dropdown(self):
                 response,
                 reverse('series-mbox', kwargs={'series_id': series_.id}))
 
+    def test_escaping(self):
+        # Warning: this test doesn't guarantee anything - it only tests some
+        # fields
+        unescaped_string = 'blah<b>TEST</b>blah'
+        patch = create_patch()
+        patch.diff = unescaped_string
+        patch.commit_ref = unescaped_string
+        patch.pull_url = unescaped_string
+        patch.name = unescaped_string
+        patch.msgid = unescaped_string
+        patch.headers = unescaped_string
+        patch.content = unescaped_string
+        patch.save()
+        requested_url = reverse('patch-detail', kwargs={'patch_id': patch.id})
+        response = self.client.get(requested_url)
+        self.assertNotIn('<b>TEST</b>'.encode('utf-8'), response.content)
+
 
 class CommentRedirectTest(TestCase):