Skip to content

Commit f56d98e

Browse files
kabothukabothu
authored
Merge pull request #152 from magento-pangolin/MC-11438
MC-11438
2 parents 04e79d6 + 2bc6e2b commit f56d98e

File tree

4 files changed

+96
-1
lines changed

4 files changed

+96
-1
lines changed

‎app/code/Magento/Checkout/Test/Mftf/ActionGroup/AssertAdminEmailValidationMessageOnCheckoutActionGroup.xml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<actionGroups xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/actionGroupSchema.xsd">
11+
<actionGroup name="AssertAdminEmailValidationMessageOnCheckoutActionGroup">
12+
<arguments>
13+
<argument name="message" type="string" defaultValue="Please enter a valid email address (Ex: johndoe@domain.com)."/>
14+
</arguments>
15+
<waitForElementVisible selector="{{AdminOrderFormAccountSection.emailErrorMessage}}" stepKey="waitForFormValidation"/>
16+
<see selector="{{AdminOrderFormAccountSection.emailErrorMessage}}" userInput="{{message}}" stepKey="seeTheErrorMessageIsDisplayed"/>
17+
</actionGroup>
18+
</actionGroups>

‎app/code/Magento/Customer/Test/Mftf/Data/CustomerData.xml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,19 @@
271271
<requiredEntity type="address">US_Address_TX</requiredEntity>
272272
<requiredEntity type="address">US_Address_NY_Not_Default_Address</requiredEntity>
273273
</entity>
274+
<entity name="Simple_US_Customer_Incorrect_Email" type="customer">
275+
<data key="group_id">0</data>
276+
<data key="default_billing">true</data>
277+
<data key="default_shipping">true</data>
278+
<data key="email">&gt;&lt;script&gt;alert(1);&lt;/script&gt;@example.com</data>
279+
<data key="firstname">John</data>
280+
<data key="lastname">Doe</data>
281+
<data key="fullname">John Doe</data>
282+
<data key="password">pwdTest123!</data>
283+
<data key="store_id">0</data>
284+
<data key="website_id">0</data>
285+
<requiredEntity type="address">US_Address_CA</requiredEntity>
286+
</entity>
274287
<entity name="John_Smith_Customer" type="customer">
275288
<data key="group_id">1</data>
276289
<data key="email" unique="prefix">john.smith@example.com</data>

‎app/code/Magento/Sales/Test/Mftf/Section/AdminOrderFormAccountSection.xml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,7 @@
1414
<element name="requiredGroup" type="text" selector=".admin__field.required[data-ui-id='billing-address-fieldset-element-form-field-group-id']"/>
1515
<element name="requiredEmail" type="text" selector=".admin__field.required[data-ui-id='billing-address-fieldset-element-form-field-email']"/>
1616
<element name="defaultGeneral" type="text" selector="//*[contains(text(),'General')]" timeout="15"/>
17+
<element name="emailErrorMessage" type="text" selector="#email-error"/>
18+
<element name="defaultGeneral" type="text" selector="//*[contains(text(),'General')]" timeout="15"/>
1719
</section>
18-
</sections>
20+
</sections>

‎app/code/Magento/Sales/Test/Mftf/Test/CheckXSSVulnerabilityDuringOrderCreationTest.xml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
11+
<test name="CheckXSSVulnerabilityDuringOrderCreationTest">
12+
<annotations>
13+
<features value="Sales"/>
14+
<stories value="Create order"/>
15+
<title value="Check XSS vulnerability during order creation test"/>
16+
<description value="Order should not be created with XSS vulnerability in email address"/>
17+
<severity value="CRITICAL"/>
18+
<testCaseId value="MC-11438"/>
19+
<group value="sales"/>
20+
</annotations>
21+
<before>
22+
<!-- Create product -->
23+
<createData entity="SimpleProduct2" stepKey="createProduct"/>
24+
</before>
25+
<after>
26+
<!-- Delete product -->
27+
<deleteData createDataKey="createProduct" stepKey="deleteProduct"/>
28+
29+
<!-- Log out -->
30+
<actionGroup ref="logout" stepKey="logout"/>
31+
</after>
32+
33+
<!-- Add product to the shopping cart -->
34+
<actionGroup ref="OpenStoreFrontProductPageActionGroup" stepKey="openProductPage">
35+
<argument name="productUrlKey" value="$$createProduct.custom_attributes[url_key]$$"/>
36+
</actionGroup>
37+
<actionGroup ref="StorefrontAddProductToCartActionGroup" stepKey="addProductToCart">
38+
<argument name="product" value="$$createProduct$$"/>
39+
<argument name="productCount" value="1"/>
40+
</actionGroup>
41+
42+
<!-- Try to create order on Storefront with provided email -->
43+
<actionGroup ref="GoToCheckoutFromMinicartActionGroup" stepKey="goToCheckoutFromMinicart"/>
44+
<actionGroup ref="StorefrontFillEmailFieldOnCheckoutActionGroup" stepKey="fillIncorrectEmailStorefront">
45+
<argument name="email" value="{{Simple_US_Customer_Incorrect_Email.email}}"/>
46+
</actionGroup>
47+
48+
<!-- Order can not be created -->
49+
<actionGroup ref="AssertStorefrontEmailValidationMessageOnCheckoutActionGroup" stepKey="assertErrorMessageStorefront"/>
50+
51+
<!-- Login as admin -->
52+
<actionGroup ref="LoginAsAdmin" stepKey="loginAsAdmin"/>
53+
54+
<!-- Try to create order in admin with provided email -->
55+
<actionGroup ref="navigateToNewOrderPageNewCustomerSingleStore" stepKey="navigateToNewOrderPage"/>
56+
<fillField selector="{{AdminOrderFormAccountSection.email}}" userInput="{{Simple_US_Customer_Incorrect_Email.email}}" stepKey="fillEmailAddressAdminPanel"/>
57+
<click selector="{{AdminOrderFormActionSection.submitOrder}}" stepKey="clickSubmitOrder"/>
58+
59+
<!-- Order can not be created -->
60+
<actionGroup ref="AssertAdminEmailValidationMessageOnCheckoutActionGroup" stepKey="assertErrorMessageAdminPanel"/>
61+
</test>
62+
</tests>

0 commit comments

Comments
 (0)