diff --git a/InvenTree/part/test_api.py b/InvenTree/part/test_api.py index 3d2c0d8a06..eb7364eca6 100644 --- a/InvenTree/part/test_api.py +++ b/InvenTree/part/test_api.py @@ -148,6 +148,37 @@ class PartCategoryAPITest(InvenTreeAPITestCase): # There should not be any templates left at this point self.assertEqual(PartCategoryParameterTemplate.objects.count(), 0) + def test_bleach(self): + """Test that the data cleaning functionality is working""" + + url = reverse('api-part-category-detail', kwargs={'pk': 1}) + + self.patch( + url, + { + 'description': '', + }, + expected_code=200 + ) + + cat = PartCategory.objects.get(pk=1) + + # Image tags have been stripped + self.assertEqual(cat.description, '<img src=# onerror=alert("pwned")>') + + self.patch( + url, + { + 'description': 'LINK', + }, + expected_code=200, + ) + + # Tags must have been bleached out + cat.refresh_from_db() + + self.assertEqual(cat.description, 'LINK<script>alert("h4x0r")</script>') + class PartOptionsAPITest(InvenTreeAPITestCase): """Tests for the various OPTIONS endpoints in the /part/ API.