Skip to content

Commit 4e8b7b4

Browse files
davemacaulaydavemacaulay
committed
MC-13922: [Sec] XSS Injection in Admin For Map Location Attributes, Image Caption, Slide Name
- Add map tests - Refactor some action groups to correctly use <see /> instead of <waitForElementVisible />
1 parent d5cf175 commit 4e8b7b4

File tree

6 files changed

+179
-15
lines changed

6 files changed

+179
-15
lines changed

‎app/code/Magento/PageBuilder/Test/Mftf/ActionGroup/ContentTypeMapActionGroup.xml

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -96,14 +96,14 @@
9696
</arguments>
9797
<comment userInput="validateLocationGridData" stepKey="comment"/>
9898
<waitForElementVisible selector="{{PageBuilderDataGrid.gridBase}}" stepKey="waitForGrid"/>
99-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, locationName.fieldName, locationName.value)}}" stepKey="waitForLocationName"/>
100-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, phoneNumber.fieldName, phoneNumber.value)}}" stepKey="waitForPhoneNumber"/>
101-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, address.fieldName, address.value)}}" stepKey="waitForAddress"/>
102-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, city.fieldName, city.value)}}" stepKey="waitForCity"/>
103-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, state.fieldName, state.value)}}" stepKey="waitForState"/>
104-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, zip.fieldName, zip.value)}}" stepKey="waitForZip"/>
105-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, country.fieldName, country.value)}}" stepKey="waitForCountry"/>
106-
<waitForElementVisible selector="{{PageBuilderDataGrid.gridSelectButtonByIndex(rowIndex)}}" stepKey="waitForSelectButton"/>
99+
<see selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, locationName.fieldName)}}" userInput="{{locationName.value}}" stepKey="seeLocationName"/>
100+
<see selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, phoneNumber.fieldName)}}" userInput="{{phoneNumber.value}}" stepKey="seePhoneNumber"/>
101+
<see selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, address.fieldName)}}" userInput="{{address.value}}" stepKey="seeAddress"/>
102+
<see selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, city.fieldName)}}" userInput="{{city.value}}" stepKey="seeCity"/>
103+
<see selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, state.fieldName)}}" userInput="{{state.value}}" stepKey="seeState"/>
104+
<see selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, zip.fieldName)}}" userInput="{{zip.value}}" stepKey="setZip"/>
105+
<see selector="{{PageBuilderDataGrid.gridCellByRowIndex(rowIndex, country.fieldName)}}" userInput="{{country.value}}" stepKey="seeCounty"/>
106+
<seeElement selector="{{PageBuilderDataGrid.gridSelectButtonByIndex(rowIndex)}}" stepKey="seeSelectButton"/>
107107
</actionGroup>
108108
<actionGroup name="clickMapToAddOrMovePin">
109109
<arguments>
@@ -292,10 +292,10 @@
292292
<waitForElement selector="{{page.clickablePin(mapIndex, pinIndex)}}" stepKey="waitForPin"/>
293293
<click selector="{{page.clickablePin(mapIndex, pinIndex)}}" stepKey="clickPin"/>
294294
<waitForElementVisible selector="{{page.tooltipWindow(mapIndex)}}" stepKey="waitForPinTooltip"/>
295-
<waitForElementVisible selector="{{page.locationName(mapIndex, locationName.value)}}" stepKey="waitForLocationName"/>
296-
<waitForElementVisible selector="{{page.comment(mapIndex, comment.value)}}" stepKey="waitForComment"/>
297-
<waitForElementVisible selector="{{page.phoneNumber(mapIndex, phoneNumber.value)}}" stepKey="waitForPhoneNumber"/>
298-
<waitForElementVisible selector="{{page.addressCityStateZipCountry(mapIndex, address.value, city.value, state.tooltipValue, zip.value, country.tooltipValue)}}" stepKey="waitForAddress"/>
295+
<see selector="{{page.locationNameElement(mapIndex)}}" userInput="{{locationName.value}}" stepKey="seeLocationName"/>
296+
<see selector="{{page.commentElement(mapIndex)}}" userInput="{{comment.value}}" stepKey="seeComment"/>
297+
<see selector="{{page.phoneNumberElement(mapIndex)}}" userInput="{{phoneNumber.value}}" stepKey="seePhoneNumber"/>
298+
<see selector="{{page.addressCityStateZipCountryElement(mapIndex)}}" userInput="{{address.value}}\n{{city.value}}, {{state.tooltipValue}} {{zip.value}}\n{{country.tooltipValue}}" stepKey="seeAddress"/>
299299
<moveMouseOver selector="{{page.base(mapIndex)}}" x="-1" y="0" stepKey="moveMouseOutsideMap"/>
300300
<waitForPageLoad stepKey="waitForOptionMenuGone"/>
301301
<click selector="{{page.tooltipWindowClose(mapIndex)}}" stepKey="closePinTooltip"/>

‎app/code/Magento/PageBuilder/Test/Mftf/Data/MapData.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,12 @@
102102
<data key="fieldName">location_name</data>
103103
<data key="value">0</data>
104104
</entity>
105+
<entity name="PageBuilderMapLocationName_HtmlCode" type="pagebuilder_map_location_name_property">
106+
<data key="name">Location Name</data>
107+
<data key="section">general</data>
108+
<data key="fieldName">location_name</data>
109+
<data key="value">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
110+
</entity>
105111
<!-- Latitude -->
106112
<entity name="PageBuilderMapLatitude_Default" type="pagebuilder_map_latitude_property">
107113
<data key="name">Coordinates</data>
@@ -435,6 +441,12 @@
435441
<data key="fieldName">phone</data>
436442
<data key="value">0</data>
437443
</entity>
444+
<entity name="PageBuilderMapPhoneNumber_HtmlCode" type="pagebuilder_map_phone_number_property">
445+
<data key="name">Phone Number</data>
446+
<data key="section">general</data>
447+
<data key="fieldName">phone</data>
448+
<data key="value">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
449+
</entity>
438450
<!-- Street Address -->
439451
<entity name="PageBuilderMapStreetAddress_Default" type="pagebuilder_map_street_address_property">
440452
<data key="name">Street Address</data>
@@ -496,6 +508,12 @@
496508
<data key="fieldName">address</data>
497509
<data key="value">0</data>
498510
</entity>
511+
<entity name="PageBuilderMapStreetAddress_HtmlCode" type="pagebuilder_map_street_address_property">
512+
<data key="name">Street Address</data>
513+
<data key="section">general</data>
514+
<data key="fieldName">address</data>
515+
<data key="value">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
516+
</entity>
499517
<!-- City -->
500518
<entity name="PageBuilderMapCity_Default" type="pagebuilder_map_city_property">
501519
<data key="name">City</data>
@@ -557,6 +575,12 @@
557575
<data key="fieldName">city</data>
558576
<data key="value">0</data>
559577
</entity>
578+
<entity name="PageBuilderMapCity_HtmlCode" type="pagebuilder_map_city_property">
579+
<data key="name">City</data>
580+
<data key="section">general</data>
581+
<data key="fieldName">city</data>
582+
<data key="value">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
583+
</entity>
560584
<!-- State -->
561585
<entity name="PageBuilderMapState_Default" type="pagebuilder_map_state_property">
562586
<data key="name">State</data>
@@ -623,6 +647,13 @@
623647
<data key="fieldName">state</data>
624648
<data key="value">0</data>
625649
</entity>
650+
<entity name="PageBuilderMapState_HtmlCode" type="pagebuilder_map_state_property">
651+
<data key="name">State</data>
652+
<data key="section">general</data>
653+
<data key="fieldName">state</data>
654+
<data key="value">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
655+
<data key="tooltipValue">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
656+
</entity>
626657
<!-- Zip Code -->
627658
<entity name="PageBuilderMapZipCode_Default" type="pagebuilder_map_zip_code_property">
628659
<data key="name">Zip/Postal Code</data>
@@ -684,6 +715,12 @@
684715
<data key="fieldName">zipcode</data>
685716
<data key="value">0</data>
686717
</entity>
718+
<entity name="PageBuilderMapZipCode_HtmlCode" type="pagebuilder_map_zip_code_property">
719+
<data key="name">Zip/Postal Code</data>
720+
<data key="section">general</data>
721+
<data key="fieldName">zipcode</data>
722+
<data key="value">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
723+
</entity>
687724
<!-- Country -->
688725
<entity name="PageBuilderMapCountry_Default" type="pagebuilder_map_country_property">
689726
<data key="name">Country</data>
@@ -761,6 +798,12 @@
761798
<data key="fieldName">comment</data>
762799
<data key="value"/>
763800
</entity>
801+
<entity name="PageBuilderMapComment_HtmlCode" type="pagebuilder_map_comment_property">
802+
<data key="name">Comment</data>
803+
<data key="section">general</data>
804+
<data key="fieldName">comment</data>
805+
<data key="value">&#x3C;img src=x onerror=&#x22;throw &#x27;error&#x27;;&#x22; /&#x3E;</data>
806+
</entity>
764807
<!-- Height -->
765808
<entity name="PageBuilderMapHeightDefaultProperty" type="pagebuilder_map_height_property">
766809
<data key="name">Map Height</data>

‎app/code/Magento/PageBuilder/Test/Mftf/Section/PageBuilderDataGridSection.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
<element name="gridRow" type="text" selector="//table[@data-role='grid']//tbody//tr[descendant::span[@data-index='{{arg1}}' and .='{{arg2}}']]" parameterized="true"/>
2222
<element name="gridRowByIndex" type="text" selector="//table[@data-role='grid']//tbody//tr[{{arg1}}][descendant::span[@data-index='{{arg2}}' and .='{{arg3}}']]" parameterized="true"/>
2323
<element name="gridCell" type="text" selector="//table[@data-role='grid']//tbody//span[@data-index='{{arg1}}' and .='{{arg2}}']" parameterized="true"/>
24-
<element name="gridCellByRowIndex" type="text" selector="//table[@data-role='grid']//tbody//tr[{{arg1}}]//span[@data-index='{{arg2}}' and .='{{arg3}}']" parameterized="true"/>
24+
<element name="gridCellByRowIndex" type="text" selector="//table[@data-role='grid']//tbody//tr[{{arg1}}]//span[@data-index='{{arg2}}']" parameterized="true"/>
2525
<element name="gridSelectButton" type="button" selector="//table[@data-role='grid']//tbody//tr[descendant::span[@data-index='{{arg1}}' and .='{{arg2}}']]//td[@data-index='actions']//button[@class='action-select' and .='Select']" parameterized="true"/>
2626
<element name="gridSelectButtonByIndex" type="button" selector="//table[@data-role='grid']//tbody//tr[{{arg1}}]//td[@data-index='actions']//button[@class='action-select' and .='Select']" parameterized="true"/>
2727
<element name="gridSelectEditButton" type="button" selector="//table[@data-role='grid']//tbody//tr[descendant::span[@data-index='{{arg1}}' and .='{{arg2}}']]//td[@data-index='actions']//span[@class='action-menu-item' and .='Edit']" parameterized="true"/>

‎app/code/Magento/PageBuilder/Test/Mftf/Section/PageBuilderMapSection.xml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@
2626
<element name="phoneNumber" type="text" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[@class='gm-style-iw']//p[.='Phone: {{arg2}}']" parameterized="true"/>
2727
<element name="noPhoneNumber" type="text" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[@class='gm-style-iw']//p[.='{{arg2}}']" parameterized="true"/>
2828
<element name="addressCityStateZipCountry" type="text" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[@class='gm-style-iw']//span[.='{{arg2}}{{arg3}}{{arg4}}{{arg5}}{{arg6}}']" parameterized="true"/>
29+
<element name="locationNameElement" type="text" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[@class='gm-style-iw']//h3/b" parameterized="true"/>
30+
<element name="commentElement" type="text" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[@class='gm-style-iw']//p" parameterized="true"/>
31+
<element name="phoneNumberElement" type="text" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[@class='gm-style-iw']//p" parameterized="true"/>
32+
<element name="addressCityStateZipCountryElement" type="text" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[@class='gm-style-iw']//span" parameterized="true"/>
2933
<!-- Map Settings Configuration -->
3034
<element name="height" type="button" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[contains(@data-bind,'renderMap') and contains(@style,'height: {{arg2}}px;')]" parameterized="true"/>
3135
<element name="noHeight" type="button" selector="(//div[contains(@class,'pagebuilder-map')])[{{arg1}}]//div[contains(@data-bind,'renderMap') and not(contains(@style,'height:'))]" parameterized="true"/>
@@ -71,6 +75,10 @@
7175
<element name="phoneNumber" type="text" selector="(//div[@data-role='map'])[{{arg1}}]//div[@class='gm-style-iw']//p[.='Phone: {{arg2}}']" parameterized="true"/>
7276
<element name="noPhoneNumber" type="text" selector="(//div[@data-role='map'])[{{arg1}}]//div[@class='gm-style-iw']//p[.='{{arg2}}']" parameterized="true"/>
7377
<element name="addressCityStateZipCountry" type="text" selector="(//div[@data-role='map'])[{{arg1}}]//div[@class='gm-style-iw']//span[.='{{arg2}}{{arg3}}{{arg4}}{{arg5}}{{arg6}}']" parameterized="true"/>
78+
<element name="locationNameElement" type="text" selector="(//div[@data-role='map'])[{{arg1}}]//div[@class='gm-style-iw']//h3/b" parameterized="true"/>
79+
<element name="commentElement" type="text" selector="(//div[@data-role='map'])[{{arg1}}]//div[@class='gm-style-iw']//p" parameterized="true"/>
80+
<element name="phoneNumberElement" type="text" selector="(//div[@data-role='map'])[{{arg1}}]//div[@class='gm-style-iw']//p" parameterized="true"/>
81+
<element name="addressCityStateZipCountryElement" type="text" selector="(//div[@data-role='map'])[{{arg1}}]//div[@class='gm-style-iw']//span" parameterized="true"/>
7482
<!-- Map Settings Configuration -->
7583
<element name="height" type="button" selector="(//div[@data-role='map'])[{{arg1}}][contains(@style,'height: {{arg2}}px;')]" parameterized="true"/>
7684
<element name="noHeight" type="button" selector="(//div[@data-role='map'])[{{arg1}}][not(contains(@style,'height:'))]" parameterized="true"/>

‎app/code/Magento/PageBuilder/Test/Mftf/Test/AdminPageBuilderImageTest.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1416,8 +1416,8 @@
14161416
<actionGroup ref="navigateToCreatedCMSPage" stepKey="navigateToCreatedCMSPage">
14171417
<argument name="CMSPage" value="$$createCMSPage$$"/>
14181418
</actionGroup>
1419-
<!-- Add Image to Tab -->
1420-
<comment userInput="Add Image to Tab" stepKey="commentAddImageToTab"/>
1419+
<!-- Add Image to Stage -->
1420+
<comment userInput="Add Image to Stage" stepKey="commentAddImageToStage"/>
14211421
<actionGroup ref="expandPageBuilderPanelGroup" stepKey="expandPageBuilderPanelGroup">
14221422
<argument name="group" value="PageBuilderImageContentType"/>
14231423
</actionGroup>

0 commit comments

Comments
 (0)