XSS from test work in report #3270

VysotskiySS · 2026-03-10T11:59:34Z

VysotskiySS
Mar 10, 2026

После выполения тестов на проверку XSS уязвимостей заметил в отчете отработку этих скриптов

@pytest.mark.xss
@pytest.mark.regress
@pytest.mark.parametrize(
    "task_name",[
        'test"></script><script>alert(1)</script>',
        '<ScRiPt>alert(1)</ScRiPt>',
        '<script/random>alert(1)</script>',
        '<img src=x onerror=alert(1)>',
        '<svg onload=alert(1)>',
        '<a href="javascript:alert(1)">click</a>',
        '"><body onload=alert(1)>',
        '" onmouseover=alert(1) "',
        '" onfocus=alert(1) autofocus "',
        '" onclick=alert(1) "',
        "'; alert(1);//",
        '<style>body{background:url("javascript:alert(1)")}</style>',
    ]
)
@allure.title('График выполнения задачи с Stored XSS в имени задачи')
@allure_testcase("")
def test_task_duration_with_xss(self, get_ip_server, task_name):
    login = LoginPage()
    login.login()
    page = UEMPage()
    page.open_uem()
    page.open_tasks()
    page.clear_all_in_list()
    page.add_task(task_name)
    task_id = page.get_task_id_from_success_msg()
    page.open_duration_task(task_id, ip_server=get_ip_server)
    page.assert_no_alert()

@pytest.mark.xss
@pytest.mark.regress
@pytest.mark.parametrize(
    "payload",[
        'test"></script><script>alert(1)</script>',
        '</script><script>alert(1)</script>',
        '<ScRiPt>alert(1)</ScRiPt>',
        '<script/random>alert(1)</script>',
        '<img src=x onerror=alert(1)>',
        '<svg onload=alert(1)>',
        '<a href="javascript:alert(1)">click</a>',
        '"><body onload=alert(1)>',
        '" onmouseover=alert(1) "',
        '" onfocus=alert(1) autofocus "',
        '" onclick=alert(1) "',
        "'; alert(1);//",
    ]
)
@allure.title('Проверка уязвимости Reflected XSS')
@allure_testcase("")
def test_reflected_xss(self, get_ip_server, payload):
    login = LoginPage()
    login.login()
    login.open_url(f'https://{get_ip_server}/dashboard/graph/?id=123"{payload}')
    login.assert_no_alert()

2026-03-10.18-50-54.webm

Answered by baev

Mar 13, 2026

fixed 2.38.0

View full answer

baev · 2026-03-13T18:43:24Z

baev
Mar 13, 2026
Maintainer

fixed 2.38.0

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allure Framework

XSS from test work in report #3270

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Allure Framework

XSS from test work in report #3270

Uh oh!

VysotskiySS Mar 10, 2026

Replies: 1 comment

Uh oh!

baev Mar 13, 2026 Maintainer

VysotskiySS
Mar 10, 2026

baev
Mar 13, 2026
Maintainer