feat: extend optional HTML feedback to graduate imports in 0.7.8

server/feedback/tests/fixtures/client-graduate-exams.html

@@ -0,0 +1,5 @@
+<!doctype html><!-- TPSchedule school diagnostic --><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; base-uri 'none'; form-action 'none'"><title>TPSchedule school diagnostic</title></head><body><select id="xqbh"><option value="73" selected="">2026-2027秋</option></select><table id="sample-table-1"><thead><tr>
+<th>id</th><th>序号</th><th>学号</th><th>姓名</th><th>课程代码</th><th>课程名称</th><th>考核方式</th><th>考生编号</th><th>考场顺序号</th><th>考场</th><th>座位号</th><th>考试时间</th>
+</tr></thead><tbody><tr>
+<td>1</td><td>1</td><td>private-id</td><td>private-name</td><td>MATH</td><td>矩阵理论</td><td>笔试</td><td></td><td></td><td>示例考场</td><td></td><td></td>
+</tr></tbody></table><script type="application/x-tpschedule-course-data"></script></body></html>

server/feedback/tests/fixtures/client-graduate-timetable.html

@@ -0,0 +1 @@
+<!doctype html><!-- TPSchedule school diagnostic --><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; base-uri 'none'; form-action 'none'"><title>TPSchedule school diagnostic</title></head><body><select id="drpxq"><option value="73" selected="">2026-2027秋</option></select><table id="tbl"><tbody><tr><th>节次</th><th>星期一</th><th>星期二</th><th>星期三</th><th>星期四</th><th>星期五</th><th>星期六</th><th>星期日</th></tr><tr><td id="t01">1-2节</td><td id="t11"></td><td id="t21"></td><td id="t31"></td><td id="t41"></td><td id="t51">101/示例集成电路设计(1班)/32/2/示例教师甲/1-3周/1~2节/示例楼B212<br>101/示例集成电路设计(1班)/32/2/示例教师甲/6-6周/1~2节/示例楼B212<br>101/示例集成电路设计(1班)/32/2/示例教师甲/7-9周/1~2节/示例楼B212</td><td id="t61"></td><td id="t71"></td></tr><tr><td id="t03">3-4节</td><td id="t13">101/示例集成电路设计(1班)/32/2/示例教师甲/1-5周/3~4节/示例楼B212</td><td id="t23">102/示例信号检测与估计(2班)/32/2/示例教师乙、示例教师丙/1-5周/3~4节/示例楼B102<br>102/示例信号检测与估计(2班)/32/2/示例教师乙、示例教师丙/7-9周/3~4节/示例楼B102</td><td id="t33"></td><td id="t43"></td><td id="t53"></td><td id="t63"></td><td id="t73"></td></tr><tr><td id="t05">5-6节</td><td id="t15"></td><td id="t25"></td><td id="t35"></td><td id="t45"></td><td id="t55"></td><td id="t65"></td><td id="t75"></td></tr><tr><td id="t07">7-8节</td><td id="t17"></td><td id="t27"></td><td id="t37"></td><td id="t47"></td><td id="t57"></td><td id="t67"></td><td id="t77"></td></tr><tr><td id="t09">9-11节</td><td id="t19"></td><td id="t29">103/示例现代化理论与实践(3班)/36/2/示例教师丁/1-12周/9~11节/示例楼B107</td><td id="t39"></td><td id="t49"></td><td id="t59"></td><td id="t69"></td><td id="t79"></td></tr></tbody></table><script type="application/x-tpschedule-course-data"></script></body></html>

server/feedback/tests/test_feedback.py

@@ -31,6 +31,35 @@ def test_real_client_generated_synthetic_html_is_accepted_as_attachment(service)
     assert attachment.get_payload(decode=True) == page
 
 
+@pytest.mark.parametrize('fixture', ['client-graduate-timetable.html', 'client-graduate-exams.html'])
+def test_real_graduate_client_html_is_mailed_without_changing_its_evidence(service, fixture):
+    client, sender, _ = service
+    page = (Path(__file__).parent / 'fixtures' / fixture).read_bytes()
+    fields = [('submission_id', (None, ID)), ('type', (None, 'problem')), ('message', (None, 'Graduate import failed'))]
+    response = client.post('/v1/feedback', files=fields + [('diagnostic_html', ('page.html', page, 'text/html'))])
+    assert response.status_code == 200
+    attachment = list(sender.messages[0].iter_attachments())[0]
+    assert attachment.get_filename() == 'TPSchedule-school-page.html'
+    assert attachment.get_payload(decode=True) == page
+
+
+@pytest.mark.parametrize('extra', [
+    '<select id="account"><option value="73">Account</option></select>',
+    '<select id="drpxq" onchange="steal()"><option value="73">Term</option></select>',
+    '<select id="xqbh"><option value="https://evil.test/">Term</option></select>',
+    '<option value="73" selected>Outside semester selector</option>',
+    '<select id="drpxq"><option value="73" selected onclick="steal()">Term</option></select>',
+    '<table id="account"><tr><td id="token">Secret</td></tr></table>',
+])
+def test_graduate_diagnostics_reject_unrelated_or_active_controls(service, extra):
+    client, sender, _ = service
+    page = HTML.replace(b'</body>', extra.encode() + b'</body>')
+    fields = [('submission_id', (None, ID)), ('type', (None, 'problem')), ('message', (None, 'Graduate import failed'))]
+    response = client.post('/v1/feedback', files=fields + [('diagnostic_html', ('page.html', page, 'text/html'))])
+    assert response.status_code == 415
+    assert not sender.messages
+
+
 @pytest.mark.parametrize('extra', [
     '<script>alert(1)</script>', '<img src="https://evil.test/">',
     '<table onclick="alert(1)"></table>', '<meta http-equiv="refresh" content="0;url=https://evil.test/">',