feat: extend optional HTML feedback to graduate imports in 0.7.8

server/feedback/tests/test_feedback.py

@@ -31,6 +31,35 @@ def test_real_client_generated_synthetic_html_is_accepted_as_attachment(service)
     assert attachment.get_payload(decode=True) == page
 
 
+@pytest.mark.parametrize('fixture', ['client-graduate-timetable.html', 'client-graduate-exams.html'])
+def test_real_graduate_client_html_is_mailed_without_changing_its_evidence(service, fixture):
+    client, sender, _ = service
+    page = (Path(__file__).parent / 'fixtures' / fixture).read_bytes()
+    fields = [('submission_id', (None, ID)), ('type', (None, 'problem')), ('message', (None, 'Graduate import failed'))]
+    response = client.post('/v1/feedback', files=fields + [('diagnostic_html', ('page.html', page, 'text/html'))])
+    assert response.status_code == 200
+    attachment = list(sender.messages[0].iter_attachments())[0]
+    assert attachment.get_filename() == 'TPSchedule-school-page.html'
+    assert attachment.get_payload(decode=True) == page
+
+
+@pytest.mark.parametrize('extra', [
+    '<select id="account"><option value="73">Account</option></select>',
+    '<select id="drpxq" onchange="steal()"><option value="73">Term</option></select>',
+    '<select id="xqbh"><option value="https://evil.test/">Term</option></select>',
+    '<option value="73" selected>Outside semester selector</option>',
+    '<select id="drpxq"><option value="73" selected onclick="steal()">Term</option></select>',
+    '<table id="account"><tr><td id="token">Secret</td></tr></table>',
+])
+def test_graduate_diagnostics_reject_unrelated_or_active_controls(service, extra):
+    client, sender, _ = service
+    page = HTML.replace(b'</body>', extra.encode() + b'</body>')
+    fields = [('submission_id', (None, ID)), ('type', (None, 'problem')), ('message', (None, 'Graduate import failed'))]
+    response = client.post('/v1/feedback', files=fields + [('diagnostic_html', ('page.html', page, 'text/html'))])
+    assert response.status_code == 415
+    assert not sender.messages
+
+
 @pytest.mark.parametrize('extra', [
     '<script>alert(1)</script>', '<img src="https://evil.test/">',
     '<table onclick="alert(1)"></table>', '<meta http-equiv="refresh" content="0;url=https://evil.test/">',