import json import demistomock as demisto import pytest def util_open_file(path): with open(path) as f: return f.read() def util_load_json(path): with open(path) as f: return json.loads(f.read()) @pytest.mark.parametrize( "list_response, expected_result", [ (util_load_json("test_data/getList_querywindow_success.json"), "success"), (util_load_json("test_data/getList_querywindow_error.json"), "fail"), ], ) def test_get_query_window(list_response, expected_result, mocker): """ Unit Test Scenario 1 - List exists Given - Query window value stored in XSOAR List When - List content is returned successfully Then - Validate that the function returns the correct window based on the list response Unit Test Scenario 2 - List retrieval fails Given - Query window value stored in XSOAR List When - List retrieval results in an error Then - Validate that the function returns the default '60 days' window - Validate that a debug message is saved indicating the list couldn't be fetched """ from PreprocessEmail import get_query_window mocker.patch.object(demisto, "executeCommand", return_value=list_response) debug_mocker = mocker.patch.object(demisto, "debug") result = get_query_window() debug_mocker_call_args = debug_mocker.call_args if expected_result == "success": assert result == "90 days" elif expected_result == "fail": assert result == "60 days" assert ( debug_mocker_call_args.args[0] == "Error occurred while trying to load the `XSOAR - Email " "Communication Days To Query` list. Using the default query time - " "60 days" ) def test_set_email_reply(): """Unit test Given - Email author, email recipients and email cc. When - Setting the email reply. Then - Validate that the email reply is in the correct format. """ from PreprocessEmail import set_email_reply expected_result = util_open_file("test_data/email_reply.txt") result = set_email_reply("test@gmail.com", '["test1@gmail.com"]', "test2@gmail.com", "test", [{"name": "image.png"}]) assert result in expected_result EMAIL_HTML = """
image 1:
image_1.png
image 2:
image_2.png

On Thu, Oct 22, 2020 at 1:56 AM Avishai Brandeis < avishai@demistodev.onmicrosoft.com> wrote:

please add multiple inline images

""" EMAIL_HTML_NO_ALT = """
""" # noqa: RUF001 EXPECTED_RESULT_1 = ( '\n
image 1:\n
image_1.png' '
image 2:\n
image_2.png

\n
On Thu,' ' Oct 22, 2020 at 1:56 AM Avishai Brandeis <\n' 'avishai@demistodev.onmicrosoft.com> wrote:
\n
\n

please add multiple inline ' "images

" ) EXPECTED_RESULT_2 = ( '\n
image 1:\n
image_1.png' '
image 2:\n
image_2.png

\n
On Thu, Oct 22, 2020 at 1:56 AM Avishai Brandeis <\navishai@demistodev.onmicrosoft.com> wrote:
\n
\n

please add ' "multiple inline images

" ) EXPECTED_RESULT_3 = ( '\n
image 1:\n
image_1.png' '
image 2:\n
image_2.png

\n
On Thu, Oct 22, 2020 at 1:56 AM Avishai Brandeis <\navishai@demistodev.onmicrosoft.com> wrote:
\n
' "
\n

please add multiple inline images

" ) EXPECTED_RESULT_XSOAR_SAAS = ( '\n
image 1:\n
image_1.png' '
image 2:\n
image_2.png

\n
On Thu,' ' Oct 22, 2020 at 1:56 AM Avishai Brandeis <\n' 'avishai@demistodev.onmicrosoft.com> wrote:
\n
\n

please add multiple inline ' "images

" ) EXPECTED_RESULT_NO_ALT = """
""" # noqa: RUF001 @pytest.mark.parametrize( "email_html,entry_id_list,expected", [ (EMAIL_HTML, [("image_1.png", "37@119")], EXPECTED_RESULT_1), (EMAIL_HTML, [], EXPECTED_RESULT_2), (EMAIL_HTML, [("image_1.png", "37@119"), ("image_2.png", "38@120")], EXPECTED_RESULT_3), (EMAIL_HTML_NO_ALT, [("image_1.png", "37@119"), ("image_2.png", "38@120")], EXPECTED_RESULT_NO_ALT), ], ) def test_create_email_html(email_html, entry_id_list, expected): """ Given - The email's Html representation. When 1. Only one of the images were uploaded to the server hence only one entry id exists within the entry id list. 2. None of the images were uploaded to the server -> an empty entry_id_list. 3. All images were uploaded to the server. Then - The images' src attribute would be replaced as expected. """ from PreprocessEmail import create_email_html result = create_email_html(email_html, entry_id_list) assert result == expected def test_create_email_html_saas(mocker): """ Given - The email's Html representation on saas xsoar/xsiam machine. When - Creating the html thread Then - The images' src attribute would be replaced as expected with a prefix of xsoar. """ from PreprocessEmail import create_email_html email_html = EMAIL_HTML entry_id_list = [("image_1.png", "37@119")] expected = EXPECTED_RESULT_XSOAR_SAAS mocker.patch("PreprocessEmail.is_xsiam_or_xsoar_saas", return_value=True) result = create_email_html(email_html, entry_id_list) assert result == expected EXPECTED_RESULT_REMOVE_MESSAGE_HISTORY = ( '\n' '
image 1:\n

image 2:\n
' '
image_2.png
' "

\n" ) @pytest.mark.parametrize("email_html, expected", [(EMAIL_HTML, EXPECTED_RESULT_REMOVE_MESSAGE_HISTORY)]) def test_remove_html_conversation_history(email_html, expected): """ Test case to remove previous conversation history from email HTML. Given: - The email's HTML representation. When: - Retrieving only the last message. Then: - Ensures that the previous messages are being deleted from the current HTML. """ from PreprocessEmail import remove_html_conversation_history result = remove_html_conversation_history(email_html) assert result == expected def test_get_entry_id_list(): """ Given - List of the email's attachments, List of files of the email's related incident. When - building an entry id list in order to replace the email's attachments source path. Then - Ensures that only the email attachments entry id's were returned and not all files entries. """ from PreprocessEmail import get_entry_id_list attachments = [ { "description": "", "name": "123-attachmentName-image_1.png", "path": "131_dd98957a-d5c3-42e0-8a81-f3ce7fa68215", "showMediaFile": False, "type": "", }, { "description": "", "name": "456-attachmentName-image_2.png", "path": "131_17545998-4b16-4e58-8e6c-2221ada856d4", "showMediaFile": False, "type": "", }, ] files = [ { "EntryID": "30@119", "Extension": "png", "Info": "image/png", "MD5": "md5", "Name": "attachment_1.png", "SHA1": "sha1", "SHA256": "sha256", "SHA512": "sha512", "SSDeep": "ssdeep", "Size": 63111, "Type": "PNG image data, 1209 x 398, 8-bit/color RGBA, non-interlaced", }, { "EntryID": "34@119", "Extension": "png", "Info": "image/png", "MD5": "md5", "Name": "attachment_2.png", "SHA1": "4sha1", "SHA256": "sha256", "SHA512": "sha512", "SSDeep": "ssdeep", "Size": 9580, "Type": "PNG image data, 264 x 60, 8-bit/color RGBA, non-interlaced", }, { "EntryID": "35@119", "Extension": "png", "Info": "image/png", "MD5": "md5", "Name": "123-attachmentName-image_1.png", "SHA1": "4sha1", "SHA256": "sha256", "SHA512": "sha512", "SSDeep": "ssdeep", "Size": 9580, "Type": "PNG image data, 264 x 60, 8-bit/color RGBA, non-interlaced", }, { "EntryID": "36@119", "Extension": "png", "Info": "image/png", "MD5": "md5", "Name": "456-attachmentName-image_2.png", "SHA1": "4sha1", "SHA256": "sha256", "SHA512": "sha512", "SSDeep": "ssdeep", "Size": 9580, "Type": "PNG image data, 264 x 60, 8-bit/color RGBA, non-interlaced", }, ] email_html = ' Test Email 2", "EmailTo": "end_user@company.com", "EmailAttachments": "['None']", "MessageDirection": "outbound", "MessageID": "", "MessageTime": "2022-02-04T20:56:53UTC", }, { "EmailBCC": "", "EmailBody": "Response from end user to SOC\r\n\r\n\r\nSignature Line\r\n\r\n\r\n\r\n______________________" # noqa: E501 "__________\r\nFrom: SOC \r\nSent: Friday, February 4, 2022 3:56 PM" "\r\nTo: End User \r\nSubject: <69433507> Test Email 2\r\n\r\nOutbound " "test message from XSOAR to User.\r\n", "EmailCC": "", "EmailCommsThreadId": "69433507", "EmailCommsThreadNumber": "0", "EmailFrom": "end_user@company.com", "EmailHTML": "Response from end user to SOC\r\n\r\n\r\nSignature Line\r\n\r\n\r\n\r\n______________________" # noqa: E501 "__________\r\nFrom: SOC \r\nSent: Friday, February 4, 2022 3:56 PM" "\r\nTo: End User \r\nSubject: <69433507> Test Email 2\r\n\r\nOutbound " "test message from XSOAR to User.\r\n", "EmailReceived": "soc_sender@company.com", "EmailReplyTo": "BY5PR09ME5460A9F1D8E34A12904AE86EB6199@BY5VR02MB5660.namprd09.prod.outlook.com", "EmailSubject": "Re: <69433507> Test Email 2", "EmailTo": "soc_sender@company.com", "EmailAttachments": "['None']", "MessageDirection": "inbound", "MessageID": "AAMkAGRmOGZlZTEzLTkyZGDtNGJkNy1iOTMxLYM0NTAwODZhZjlmNABGAAAAAAAP2ksrJ8icRL4Zhadm7iVXBwAkkBJX" # noqa: E501 "Bb0sRJWC0zdXEMqsAAAAAAEMAAAkkBJXBb0fRJWC0zdXEMqsAAApcWVYAAA=", "MessageTime": "2022-02-04T20:58:20UTC", }, { "EmailBCC": "", "EmailBody": "Outbound test message from XSOAR to User.", "EmailCC": "", "EmailCommsThreadId": "87692312", "EmailCommsThreadNumber": "1", "EmailFrom": "soc_sender@company.com", "EmailHTML": "Outbound test message from XSOAR to User.", "EmailReceived": "", "EmailReplyTo": "soc_sender@company.com", "EmailSubject": "<87692312> Test Email 4", "EmailTo": "end_user@company.com", "EmailAttachments": "['None']", "MessageDirection": "outbound", "MessageID": "", "MessageTime": "2022-02-04T20:56:53UTC", }, { "EmailBCC": "", "EmailBody": "Response from end user to SOC\r\n\r\n\r\nSignature Line\r\n\r\n\r\n\r\n______________________" # noqa: E501 "__________\r\nFrom: SOC \r\nSent: Friday, February 4, 2022 3:56 PM" "\r\nTo: End User \r\nSubject: <87692312> Test Email 4\r\n\r\nOutbound " "test message from XSOAR to User.\r\n", "EmailCC": "", "EmailCommsThreadId": "87692312", "EmailCommsThreadNumber": "1", "EmailFrom": "end_user@company.com", "EmailHTML": "Response from end user to SOC\r\n\r\n\r\nSignature Line\r\n\r\n\r\n\r\n______________________" # noqa: E501 "__________\r\nFrom: SOC \r\nSent: Friday, February 4, 2022 3:56 PM" "\r\nTo: End User \r\nSubject: <87692312> Test Email 4\r\n\r\nOutbound " "test message from XSOAR to User.\r\n", "EmailReceived": "soc_sender@company.com", "EmailReplyTo": "BY5PR03ME5460A9F1D8E34A12904AE86EB6191@BY5VR12MB5660.namprd09.prod.outlook.com", "EmailSubject": "Re: <87692312> Test Email 4", "EmailTo": "soc_sender@company.com", "EmailAttachments": "['None']", "MessageDirection": "inbound", "MessageID": "AAMkAGRcOGZlZTEzLTkyZGDtNGJkNy1iOWMxLYM0NTAwODZhZjlxNABGAAAAAAAP2ksrJ8icRL4Zhadm7iVXBwAkkBJX" # noqa: E501 "Bb0sRJWC0zdXEMqsAAAAAAEMAAAkkBJFBb0fRJWC0zdXEMqsABApcWVYAAA=", "MessageTime": "2022-02-04T20:58:20UTC", }, ], } } } ] @pytest.mark.parametrize( "return_incident_path,expected_return,create_context_called", [ ("test_data/email_related_incident_response.json", False, False), ("test_data/email_related_incident_response_2.json", False, True), ], ) def test_main(return_incident_path, expected_return, create_context_called, mocker): """ Unit Test Scenario 1 - Email Communication Incident Given - A new incident of type Email Communication When - An email reply to an existing incident was sent - The related incident the email is in response to is an Email Communication incident Then - Validate script returns False to drop the newly created incident and attach the relevant data to the existing email related incident. Unit Test Scenario 2 - Ransomware Incident Given - A new incident of type Email Communication When - An email reply to an existing incident was sent - The related incident the email is in response to is a Ransomware incident using the 'Email Threads' layout Then - Validate script returns False to drop the newly created incident and attach the relevant data to the existing email related incident's context """ import PreprocessEmail from PreprocessEmail import main incident = util_load_json("test_data/get_incident_details_result.json") mocker.patch.object(demisto, "incident", return_value=incident) mocker.patch.object(PreprocessEmail, "get_email_related_incident_id", return_value="123") mocker.patch.object(PreprocessEmail, "get_incident_by_query", return_value=[util_load_json(return_incident_path)]) mocker.patch.object(PreprocessEmail, "get_attachments_using_instance") mocker.patch.object(PreprocessEmail, "get_incident_related_files", return_value=FILES) mocker.patch.object(demisto, "debug") create_thread_context_mocker = mocker.patch("PreprocessEmail.create_thread_context") mocker.patch.object(demisto, "results") main() assert create_thread_context_mocker.called == create_context_called assert demisto.results.call_args[0][0] == expected_return @pytest.mark.parametrize("email_code, scenario", [("87692312", "thread_found"), ("123", "thread_notfound")]) def test_create_thread_context(email_code, scenario, mocker): """Unit test Given: - all required function arguments are provided When: - creating new context entry to store email thread data Then - validate that function calls demisto.executeCommand() with all arguments and data needed to properly create the required context entry """ # demisto.executeCommand will be called twice in the tested function - prepare separate responses for each def side_effect_function(command, args): if command == "getContext": return EMAIL_THREADS elif command == "executeCommandAt": return True return None from PreprocessEmail import create_thread_context # Mock function to get current time string to match the expected result mocker.patch( "PreprocessEmail.get_current_time_in_timezone", return_value="2022-02-04T20:58:20UTC", ) execute_command_mocker = mocker.patch.object(demisto, "executeCommand", side_effect=side_effect_function) create_thread_context( email_code, "cc_user@company.com", "bcc_user@company.com", "Email body.", "soc_sender@company.com", "body>", "10", "soc_sender@company.com", "soc_sender@company.com", "Email Subject", "end_user@company.com", "123", "", time_zone="UTC", ) call_args = execute_command_mocker.call_args if scenario == "thread_found": expected = { "EmailCommsThreadId": "87692312", "EmailCommsThreadNumber": "1", "EmailCC": "cc_user@company.com", "EmailBCC": "bcc_user@company.com", "EmailBody": "Email body.", "EmailFrom": "soc_sender@company.com", "EmailHTML": "body>", "MessageID": "10", "EmailReceived": "soc_sender@company.com", "EmailReplyTo": "soc_sender@company.com", "EmailSubject": "Email Subject", "EmailTo": "end_user@company.com", "EmailAttachments": "['None']", "MessageDirection": "inbound", "MessageTime": "2022-02-04T20:58:20UTC", } assert call_args.args[1]["arguments"]["value"] == expected elif scenario == "thread_notfound": expected = { "EmailCommsThreadId": "123", "EmailCommsThreadNumber": "2", "EmailCC": "cc_user@company.com", "EmailBCC": "bcc_user@company.com", "EmailBody": "Email body.", "EmailFrom": "soc_sender@company.com", "EmailHTML": "body>", "MessageID": "10", "EmailReceived": "soc_sender@company.com", "EmailReplyTo": "soc_sender@company.com", "EmailSubject": "Email Subject", "EmailTo": "end_user@company.com", "EmailAttachments": "['None']", "MessageDirection": "inbound", "MessageTime": "2022-02-04T20:58:20UTC", } assert call_args.args[1]["arguments"]["value"] == expected def test_get_email_related_incident_id_email_in_fields(mocker): """ Given - Multiple incidents with the same identifying code When - Making a query for all incidents with a certain identifying code but with different subjects Then - Validate that the correct incident is returned (the one with the matching subject) """ import PreprocessEmail from PreprocessEmail import get_email_related_incident_id mocker.patch.object( PreprocessEmail, "get_incident_by_query", return_value=[{"emailsubject": "subject 1", "id": "1"}, {"emailsubject": "subject 2", "id": "2"}], ) id = get_email_related_incident_id("12345678", "subject 2") assert id == "2" def test_get_email_related_incident_id_email_in_context(mocker): """ Given - An incident with the matching identifying code When - The incident does not have a value for 'emailsubject' - The incident contains email threads stored in context Then - Validate that the incident ID is returned after searching email threads """ import PreprocessEmail from PreprocessEmail import get_email_related_incident_id mocker.patch.object(PreprocessEmail, "get_incident_by_query", return_value=[{"emailsubject": None, "id": "3"}]) mocker.patch.object(demisto, "executeCommand", return_value=EMAIL_THREADS) id = get_email_related_incident_id("69433507", "Test Email 2") assert id == "3" def test_main_untagged_email(mocker): """ Given - A new incident of type Email Communication When - An email on a non-existing email was received - The configuration is to disable un-tagged email creation. Then - Validate that no relevant incident was created """ from PreprocessEmail import main mocker.patch.object(demisto, "incident", return_value={"CustomFields": {}}) mocker.patch.object(demisto, "args", return_value={"CreateIncidentUntaggedEmail": False}) mocker.patch.object(demisto, "debug") mocker.patch.object(demisto, "results") main() # assert create_thread_context_mocker.called == create_context_called assert isinstance(demisto.results.call_args[0][0], bool) assert demisto.results.call_args[0][0] is False @pytest.mark.parametrize( "labels, email_to, result", [ ( [ {"type": "Email/ID", "value": "foo@test.com"}, {"type": "Instance", "value": "ews"}, {"type": "Brand", "value": "EWSO365"}, ], "test@test.com", {"arguments": {"item-id": "foo@test.com", "using": "ews"}, "command": "ews-get-attachment", "incidents": None}, ), ( [ {"type": "Email/ID", "value": "foo@test.com"}, {"type": "Instance", "value": "gmail"}, {"type": "Brand", "value": "Gmail"}, ], "test@gmail.com", { "arguments": {"message-id": "foo@test.com", "user-id": "me", "using": "gmail"}, "command": "gmail-get-attachments", "incidents": None, }, ), ( [ {"type": "Email/ID", "value": "foo@outlook.com"}, {"type": "Instance", "value": "MicrosoftGraphMail"}, {"type": "Brand", "value": "MicrosoftGraphMail"}, ], "test@outlook.com", { "command": "msgraph-mail-get-attachment", "incidents": None, "arguments": {"user_id": "test@outlook.com", "message_id": "foo@outlook.com", "using": "MicrosoftGraphMail"}, }, ), ], ) def test_get_attachments_using_instance(labels, email_to, result, mocker): from PreprocessEmail import get_attachments_using_instance mocker.patch.object(demisto, "executeCommand") get_attachments_using_instance(None, labels, email_to) assert demisto.executeCommand.call_args[0][1] == result ATTACHMENTS = [ { "description": "", "name": "image_1.png", "path": "131_dd98957a-d5c3-42e0-8a81-f3ce7fa68215", "showMediaFile": False, "type": "", }, { "description": "", "name": "image_2.png", "path": "131_dd98957a-d5c3-42e0-8a81-f3ce7fa68215", "showMediaFile": False, "type": "", }, ] ATTACHMENTS_2 = [ { "description": "", "name": "123-attachmentName-image_1.png", "path": "131_dd98957a-d5c3-42e0-8a81-f3ce7fa68215", "showMediaFile": False, "type": "", }, { "description": "", "name": "456-attachmentName-image_2.png", "path": "131_dd98957a-d5c3-42e0-8a81-f3ce7fa68215", "showMediaFile": False, "type": "", }, { "description": "", "name": "image_3.png", "path": "131_dd98957a-d5c3-42e0-8a81-f3ce7fa68215", "showMediaFile": False, "type": "", }, ] FILES_TEST1 = [ { "EntryID": "4@131", "Extension": "png", "Info": "image/png", "MD5": "605ebf7bc83a00840a3ea90c8ed56515", "Name": "image_1.png", "SHA1": "SHA1", "SHA256": "SHA256", "SHA512": "SHA512", "SSDeep": "SSDeep", "Size": 127884, "Type": "PNG image data, 275 x 184, 8-bit/color RGBA, non-interlaced", }, { "EntryID": "5@131", "Extension": "png", "Info": "image/png", "MD5": "605ebf7bc83a00840a3ea90c8ed56515", "Name": "image_2.png", "SHA1": "SHA1", "SHA256": "SHA256", "SHA512": "SHA512", "SSDeep": "SSDeep", "Size": 127884, "Type": "PNG image data, 275 x 184, 8-bit/color RGBA, non-interlaced", }, ] FILES_TEST2 = [ { "EntryID": "4@131", "Extension": "png", "Info": "image/png", "MD5": "605ebf7bc83a00840a3ea90c8ed56515", "Name": "123-attachmentName-image_1.png", "SHA1": "SHA1", "SHA256": "SHA256", "SHA512": "SHA512", "SSDeep": "SSDeep", "Size": 127884, "Type": "PNG image data, 275 x 184, 8-bit/color RGBA, non-interlaced", }, { "EntryID": "5@131", "Extension": "png", "Info": "image/png", "MD5": "605ebf7bc83a00840a3ea90c8ed56515", "Name": "456-attachmentName-image_2.png", "SHA1": "SHA1", "SHA256": "SHA256", "SHA512": "SHA512", "SSDeep": "SSDeep", "Size": 127884, "Type": "PNG image data, 275 x 184, 8-bit/color RGBA, non-interlaced", }, { "EntryID": "5@131", "Extension": "png", "Info": "image/png", "MD5": "605ebf7bc83a00840a3ea90c8ed56515", "Name": "image_3.png", "SHA1": "SHA1", "SHA256": "SHA256", "SHA512": "SHA512", "SSDeep": "SSDeep", "Size": 127884, "Type": "PNG image data, 275 x 184, 8-bit/color RGBA, non-interlaced", }, ] @pytest.mark.parametrize( "attachments, files, html, expected_result", [ (ATTACHMENTS, FILES_TEST1, "", [("image_1.png", "4@131"), ("image_2.png", "5@131")]), ( ATTACHMENTS_2, FILES_TEST2, """ Inline Images

Hello, World!

This is a test email with inline images.

Inline Image 1 Inline Image 2 """, [("123-attachmentName-image_1.png", "4@131"), ("456-attachmentName-image_2.png", "5@131")], ), ], ) def test_get_entry_id_list_only_attachments(attachments, files, html, expected_result): """ Given - case 1: all attachments are attached or in the original (plain) format. - case 2: 2 attachments in the new format (-attachmentName-) 1 attachment attached. When - running get_entry_id_list. Then - case 1: returns the two original entry IDs. - case 2: return only the new formatted attachments - as they should be replaced in the html. """ from PreprocessEmail import get_entry_id_list assert get_entry_id_list(attachments, files, html) == expected_result @pytest.mark.parametrize( "html, entry_id_list, expected_result", [ ( """ Inline Images

Hello, World!

This is a test email with inline images.

image_1.png """, [("123-attachmentName-image_1.png", "4@131"), ("image_2.png", "5@131")], """ Inline Images

Hello, World!

This is a test email with inline images.

image_1.png """, ), ( """ Inline Images

Hello, World!

This is a test email with inline images.

image_1.png """, [("image_1.png", "4@131"), ("image_2.png", "5@131")], """ Inline Images

Hello, World!

This is a test email with inline images.

image_1.png """, ), ( """ Inline Images

Hello, World!

This is a test email with inline images.

""", [("image_1.png", "4@131"), ("image_2.png", "5@131")], """ Inline Images

Hello, World!

This is a test email with inline images.

""", ), ], ) def test_create_email_html_no_image_to_insert(html, entry_id_list, expected_result): """ Given - case 1: one image to replace in html with new name format. - case 2: one image to replace in html with old name format. - case 3: no images to replace. When - running create_email_html. Then returns the expected html. """ from PreprocessEmail import create_email_html assert create_email_html(html, entry_id_list) == expected_result class TestSetEmailReplyXSSPrevention: """Tests for XSS prevention in set_email_reply header fields.""" def test_xss_in_email_from(self): from PreprocessEmail import set_email_reply result = set_email_reply("", "to@test.com", "cc@test.com", "

body

", None) assert "<script>" in result assert "" not in result def test_xss_in_email_to(self): from PreprocessEmail import set_email_reply result = set_email_reply("from@test.com", "", "cc@test.com", "

body

", None) assert "<img src=x" in result assert "", "

body

", None) assert "<iframe" in result def test_xss_in_attachment_names(self): from PreprocessEmail import set_email_reply attachments = [{"name": ""}] result = set_email_reply("from@test.com", "to@test.com", "cc@test.com", "

body

", attachments) assert "<script>" in result assert "

World

") assert "" result = sanitize_html_body(malicious_html) assert result == malicious_html