1 # Copyright (C) 2018-2020 all contributors <meta@public-inbox.org>
2 # License: AGPL-3.0+ <https://www.gnu.org/licenses/agpl-3.0.txt>
7 use PublicInbox::Config;
8 use PublicInbox::TestCommon;
9 my @mods = qw(DBD::SQLite HTTP::Request::Common Plack::Test
10 URI::Escape Plack::Builder PublicInbox::WWW);
14 use_ok 'PublicInbox::WWW';
15 use_ok 'PublicInbox::V2Writable';
16 my ($inboxdir, $for_destroy) = tmpdir();
17 my $cfgpfx = "publicinbox.bad-mids";
19 inboxdir => $inboxdir,
22 -primary_address => 'test@example.com',
23 indexlevel => 'basic',
25 $ibx = PublicInbox::Inbox->new($ibx);
26 my $im = PublicInbox::V2Writable->new($ibx, 1);
30 F1V5OR6NMF.3M649JTLO9IXD@tux.localdomain/hehe1"'<foo
31 F1V5NB0PTU.3U0DCVGAJ750Z@tux.localdomain"'<>/foo
32 F1V5NB0PTU.3U0DCVGAJ750Z@tux&.ampersand
33 F1V5MIHGCU.2ABINKW6WBE8N@tux.localdomain/raw
34 F1V5LF9D9C.2QT5PGXZQ050E@tux.localdomain/t.atom
35 F1V58X3CMU.2DCCVAKQZGADV@tux.localdomain/../../../../foo
36 F1TVKINT3G.2S6I36MXMHYG6@tux.localdomain" onclick="alert(1)"
38 my @mids = split(/\n/, $msgs);
40 foreach my $mid (@mids) {
46 Date: Fri, 02 Oct 1993 00:00:0$i +0000
49 my $mime = PublicInbox::Eml->new(\$data);
50 ok($im->add($mime), "added $mid");
56 $cfgpfx.address=$ibx->{-primary_address}
57 $cfgpfx.inboxdir=$inboxdir
59 my $config = PublicInbox::Config->new(\$cfg);
60 my $www = PublicInbox::WWW->new($config);
61 test_psgi(sub { $www->call(@_) }, sub {
63 my $res = $cb->(GET('/bad-mids/'));
64 is($res->code, 200, 'got 200 OK listing');
65 my $raw = $res->content;
66 foreach my $mid (@mids) {
67 ok(index($raw, $mid) < 0, "escaped $mid");
70 my (@xmids) = ($raw =~ m!\bhref="([^"]+)/t\.mbox\.gz"!sg);
71 is(scalar(@xmids), scalar(@mids),
72 'got escaped links to all messages');
74 @xmids = reverse @xmids;
75 my %uxs = ( gt => '>', lt => '<' );
76 foreach my $i (0..$#xmids) {
78 $uri =~ s/&#([0-9]+);/sprintf("%c", $1)/sge;
79 $uri =~ s/&(lt|gt);/$uxs{$1}/sge;
80 $res = $cb->(GET("/bad-mids/$uri/raw"));
81 is($res->code, 200, 'got 200 OK raw message '.$uri);
82 like($res->content, qr/Message-ID: <\Q$mids[$i]\E>/s,
83 'retrieved correct message');