Skip to content

Commit 2d8f5c6

Browse files
mkovdryshmkovdrysh
committed
MC-11438: There is no XSS vulnerability if Create Order with sample email
1 parent cb73be4 commit 2d8f5c6

File tree

5 files changed

+111
-0
lines changed

5 files changed

+111
-0
lines changed

‎app/code/Magento/Catalog/Test/Mftf/ActionGroup/OpenStoreFrontProductPageActionGroup.xml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
<actionGroups xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
9+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/actionGroupSchema.xsd">
10+
<actionGroup name="OpenStoreFrontProductPageActionGroup">
11+
<arguments>
12+
<argument name="productUrlKey" type="string"/>
13+
</arguments>
14+
<amOnPage url="{{StorefrontProductPage.url(productUrlKey)}}" stepKey="amOnProductPage"/>
15+
<waitForPageLoad stepKey="waitForProductPageLoad"/>
16+
</actionGroup>
17+
</actionGroups>

‎app/code/Magento/Checkout/Test/Mftf/ActionGroup/AssertAdminEmailValidationMessageOnCheckoutActionGroup.xml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<actionGroups xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/actionGroupSchema.xsd">
11+
<actionGroup name="AssertAdminEmailValidationMessageOnCheckoutActionGroup">
12+
<arguments>
13+
<argument name="message" type="string" defaultValue="Please enter a valid email address (Ex: [email protected])."/>
14+
</arguments>
15+
<waitForElementVisible selector="{{AdminOrderFormAccountSection.emailErrorMessage}}" stepKey="waitForFormValidation"/>
16+
<see selector="{{AdminOrderFormAccountSection.emailErrorMessage}}" userInput="{{message}}" stepKey="seeTheErrorMessageIsDisplayed"/>
17+
</actionGroup>
18+
</actionGroups>

‎app/code/Magento/Customer/Test/Mftf/Data/CustomerData.xml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,4 +271,17 @@
271271
<requiredEntity type="address">US_Address_TX</requiredEntity>
272272
<requiredEntity type="address">US_Address_NY_Not_Default_Address</requiredEntity>
273273
</entity>
274+
<entity name="Simple_US_Customer_Incorrect_Email" type="customer">
275+
<data key="group_id">0</data>
276+
<data key="default_billing">true</data>
277+
<data key="default_shipping">true</data>
278+
<data key="email">&gt;&lt;script&gt;alert(1);&lt;/script&gt;@example.com</data>
279+
<data key="firstname">John</data>
280+
<data key="lastname">Doe</data>
281+
<data key="fullname">John Doe</data>
282+
<data key="password">pwdTest123!</data>
283+
<data key="store_id">0</data>
284+
<data key="website_id">0</data>
285+
<requiredEntity type="address">US_Address_CA</requiredEntity>
286+
</entity>
274287
</entities>

‎app/code/Magento/Sales/Test/Mftf/Section/AdminOrderFormAccountSection.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,6 @@
1414
<element name="requiredGroup" type="text" selector=".admin__field.required[data-ui-id='billing-address-fieldset-element-form-field-group-id']"/>
1515
<element name="requiredEmail" type="text" selector=".admin__field.required[data-ui-id='billing-address-fieldset-element-form-field-email']"/>
1616
<element name="defaultGeneral" type="text" selector="//*[contains(text(),'General')]" time="15"/>
17+
<element name="emailErrorMessage" type="text" selector="#email-error"/>
1718
</section>
1819
</sections>

‎app/code/Magento/Sales/Test/Mftf/Test/CheckXSSVulnerabilityDuringOrderCreationTest.xml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
11+
<test name="CheckXSSVulnerabilityDuringOrderCreationTest">
12+
<annotations>
13+
<features value="Sales"/>
14+
<stories value="Create order"/>
15+
<title value="Check XSS vulnerability during order creation test"/>
16+
<description value="Order should not be created with XSS vulnerability in email address"/>
17+
<severity value="CRITICAL"/>
18+
<testCaseId value="MC-11438"/>
19+
<group value="sales"/>
20+
</annotations>
21+
<before>
22+
<!-- Create product -->
23+
<createData entity="SimpleProduct2" stepKey="createProduct"/>
24+
</before>
25+
<after>
26+
<!-- Delete product -->
27+
<deleteData createDataKey="createProduct" stepKey="deleteProduct"/>
28+
29+
<!-- Log out -->
30+
<actionGroup ref="logout" stepKey="logout"/>
31+
</after>
32+
33+
<!-- Add product to the shopping cart -->
34+
<actionGroup ref="OpenStoreFrontProductPageActionGroup" stepKey="openProductPage">
35+
<argument name="productUrlKey" value="$$createProduct.custom_attributes[url_key]$$"/>
36+
</actionGroup>
37+
<actionGroup ref="StorefrontAddProductToCartActionGroup" stepKey="addProductToCart">
38+
<argument name="product" value="$$createProduct$$"/>
39+
<argument name="productCount" value="1"/>
40+
</actionGroup>
41+
42+
<!-- Try to create order on Storefront with provided email -->
43+
<actionGroup ref="GoToCheckoutFromMinicartActionGroup" stepKey="goToCheckoutFromMinicart"/>
44+
<actionGroup ref="StorefrontFillEmailFieldOnCheckoutActionGroup" stepKey="fillIncorrectEmailStorefront">
45+
<argument name="email" value="{{Simple_US_Customer_Incorrect_Email.email}}"/>
46+
</actionGroup>
47+
48+
<!-- Order can not be created -->
49+
<actionGroup ref="AssertStorefrontEmailValidationMessageOnCheckoutActionGroup" stepKey="assertErrorMessageStorefront"/>
50+
51+
<!-- Login as admin -->
52+
<actionGroup ref="LoginAsAdmin" stepKey="loginAsAdmin"/>
53+
54+
<!-- Try to create order in admin with provided email -->
55+
<actionGroup ref="navigateToNewOrderPageNewCustomerSingleStore" stepKey="navigateToNewOrderPage"/>
56+
<fillField selector="{{AdminOrderFormAccountSection.email}}" userInput="{{Simple_US_Customer_Incorrect_Email.email}}" stepKey="fillEmailAddressAdminPanel"/>
57+
<click selector="{{AdminOrderFormActionSection.submitOrder}}" stepKey="clickSubmitOrder"/>
58+
59+
<!-- Order can not be created -->
60+
<actionGroup ref="AssertAdminEmailValidationMessageOnCheckoutActionGroup" stepKey="assertErrorMessageAdminPanel"/>
61+
</test>
62+
</tests>

0 commit comments

Comments
 (0)