<filename>testsuite/tests/ui/security/test_xss_vulnerability.py
"""Tests aimed to test XSS vulnerabilities"""
import pytest

from packaging.version import Version  # noqa # pylint: disable=unused-import
from testsuite import TESTED_VERSION # noqa # pylint: disable=unused-import
from testsuite.utils import blame

from testsuite.ui.views.admin.backend.backend import BackendDetailView
from testsuite.ui.views.admin.audience.messages import SupportEmailsView

pytestmark = [
    pytest.mark.issue("https://issues.redhat.com/browse/THREESCALE-6785"),
    pytest.mark.skipif("TESTED_VERSION < Version('2.11')")]


@pytest.fixture()
def xss_backend(custom_backend, request):
    """Backends with name in form of XSS attack"""
    return custom_backend(name=f"<script>alert('{blame(request, name='xss')}');</script>", blame_name=False)


@pytest.fixture()
def xss_product(custom_service, request):
    """Product with name in form of XSS attack"""
    return custom_service({"name": f"<script>alert('{blame(request, name='xss')}');</script>"})


# pylint: disable=unused-argument
def test_xss_backends(login, navigator, xss_backend):
    """
    Test:
        - Navigate to Dashboard
        - Assert alert caused by XSS is not present
    """
    page = navigator.open(BackendDetailView, backend=xss_backend)
    assert not page.browser.alert_present


# pylint: disable=unused-argument
# disabled because we only need to create product and check rendered name on page
def test_xss_support_emails(login, navigator, xss_product):
    """
    Test:
        - Navigate to Dashboard
        - Assert alert caused by XSS is not present
    """
    page = navigator.open(SupportEmailsView)
    assert not page.browser.alert_present
