import demistomock as demisto import pytest EMAIL_HTML = """
image 1:
image_1.png
image 2:
image_2.png

On Thu, Oct 22, 2020 at 1:56 AM Avishai Brandeis < avishai@demistodev.onmicrosoft.com> wrote:

please add multiple inline images

""" EMAIL_HTML_NO_ALT = """
""" # noqa: RUF001 EXPECTED_RESULT_1 = """
image 1:
image_1.png
image 2:
image_2.png

On Thu, Oct 22, 2020 at 1:56 AM Avishai Brandeis < avishai@demistodev.onmicrosoft.com> wrote:

please add multiple inline images

""" EXPECTED_RESULT_2 = """
image 1:
image_1.png
\
image 2:
image_2.png
\

On Thu, Oct 22, 2020 at 1:56 AM Avishai Brandeis < avishai@demistodev.onmicrosoft.com> wrote:

please add multiple inline images

""" EXPECTED_RESULT_NO_ALT = """
""" # noqa: RUF001 EXPECTED_RESULT_XSOAR_SAAS = """
image 1:
image_1.png
image 2:
image_2.png

On Thu, Oct 22, 2020 at 1:56 AM Avishai Brandeis < avishai@demistodev.onmicrosoft.com> wrote:

please add multiple inline images

""" @pytest.mark.parametrize( "email_html,entry_id_list,expected", [ (EMAIL_HTML, [("image_1.png", "37@119"), ("image_2.png", "38@120")], EXPECTED_RESULT_1), (EMAIL_HTML_NO_ALT, [("image_1.png", "37@119"), ("image_2.png", "38@120")], EXPECTED_RESULT_NO_ALT), ], ) def test_create_email_html(email_html, entry_id_list, expected): """ Given - The email's Html representation When 3. All images were uploaded to the server Then - The images' src attribute would be replaced as expected """ from DisplayEmailHtml import create_email_html result = create_email_html(email_html, entry_id_list) assert result == expected def test_create_email_html_saas(mocker): """ Given - The email's Html representation on saas xsoar/xsiam machine. When - Creating the html thread Then - The images' src attribute would be replaced as expected with a prefix of xsoar. """ from DisplayEmailHtml import create_email_html email_html = EMAIL_HTML entry_id_list = [("image_1.png", "37@119")] expected = EXPECTED_RESULT_XSOAR_SAAS mocker.patch("DisplayEmailHtml.is_xsiam_or_xsoar_saas", return_value=True) result = create_email_html(email_html, entry_id_list) assert result == expected @pytest.mark.parametrize( "email_html,entry_id_list,expected", [(EMAIL_HTML, [("image_1.png", "37@119"), ("image_2.png", "38@120")], EXPECTED_RESULT_2)] ) def test_create_email_html_mt(mocker, email_html, entry_id_list, expected): """ Given - The email's Html representation with multi tenant environment When - All images were uploaded to the server Then - The images' src attribute would be replaced as expected with account tenant name """ from DisplayEmailHtml import create_email_html mocker.patch.object(demisto, "demistoUrls", return_value={"server": "https://localhost:8443:/acc_test_tenant"}) result = create_email_html(email_html, entry_id_list) assert result == expected class TestSetEmailReplyXSSPrevention: """Tests for XSS prevention in set_email_reply header fields.""" def test_xss_in_email_from(self): """Validate that XSS payload in email_from is escaped.""" from DisplayEmailHtml import set_email_reply result = set_email_reply('', "to@test.com", "cc@test.com", "Subject", "

body

", None) assert "<script>" in result assert '' not in result def test_xss_in_email_to(self): """Validate that XSS payload in email_to is escaped.""" from DisplayEmailHtml import set_email_reply result = set_email_reply( "from@test.com", '', "cc@test.com", "Subject", "

body

", None ) assert "<img src=x onerror=alert("to")>" in result # The raw unescaped tag must not appear assert "', "Subject", "

body

", None) assert "<iframe src="evil.com">" in result assert "body

")[0] def test_xss_in_email_subject(self): """Validate that XSS payload in email_subject is escaped.""" from DisplayEmailHtml import set_email_reply result = set_email_reply( "from@test.com", "to@test.com", "cc@test.com", "", "

body

", None ) assert "<img src=x onerror=alert(document.domain)>" in result # The raw unescaped tag must not appear assert "alert("attach1")'}, {"name": 'file">.pdf'}, ] result = set_email_reply("from@test.com", "to@test.com", "cc@test.com", "Subject", "

body

", attachments) assert "<script>" in result # The raw unescaped tags must not appear assert "

World

') assert "" # When nh3 is not available, HTML is returned as-is result = sanitize_html_body(malicious_html) assert result == malicious_html