diff --git a/integration_test/scenarios/email_detailed/display_email_with_xss_content_scenario.dart b/integration_test/scenarios/email_detailed/display_email_with_xss_content_scenario.dart new file mode 100644 index 000000000..764dbde89 --- /dev/null +++ b/integration_test/scenarios/email_detailed/display_email_with_xss_content_scenario.dart @@ -0,0 +1,70 @@ + +import 'package:core/presentation/views/html_viewer/html_content_viewer_widget.dart'; +import 'package:flutter_test/flutter_test.dart'; +import 'package:tmail_ui_user/features/thread/presentation/widgets/email_tile_builder.dart'; + +import '../../base/base_test_scenario.dart'; +import '../../models/provisioning_email.dart'; +import '../../robots/thread_robot.dart'; + +class DisplayEmailWithXssContentScenario extends BaseTestScenario { + + const DisplayEmailWithXssContentScenario(super.$); + + static const String subject = 'Email with xss content'; + static const String xssContent = ''; + + @override + Future runTestLogic() async { + const emailUser = String.fromEnvironment('BASIC_AUTH_EMAIL'); + final provisioningEmail = ProvisioningEmail( + toEmail: emailUser, + subject: subject, + content: xssContent, + ); + + await provisionEmail([provisioningEmail], requestReadReceipt: false); + await $.pumpAndSettle(duration: const Duration(seconds: 3)); + + await _expectDisplayedEmailWithSubject(); + + final threadRobot = ThreadRobot($); + await threadRobot.openEmailWithSubject(subject); + await $.pumpAndSettle(duration: const Duration(seconds: 3)); + + await _expectEmailViewWithoutDisplayAlertDialog(); + } + + Future _expectDisplayedEmailWithSubject() async { + await expectViewVisible( + $(EmailTileBuilder) + .which( + (widget) => widget.presentationEmail.subject == subject + ), + ); + } + + Future _expectEmailViewWithoutDisplayAlertDialog() async { + expect( + find.text('XSSRobot'), + findsNothing, + ); + + expect( + $(HtmlContentViewer).which((view) { + return view.contentHtml.contains('XSSRobot'); + }), + findsNothing, + ); + + expect( + find.text('says'), + findsNothing, + ); + + expect( + find.text('OK'), + findsNothing, + ); + } +} \ No newline at end of file diff --git a/integration_test/tests/email_detailed/display_email_with_xss_content_test.dart b/integration_test/tests/email_detailed/display_email_with_xss_content_test.dart new file mode 100644 index 000000000..34508cef0 --- /dev/null +++ b/integration_test/tests/email_detailed/display_email_with_xss_content_test.dart @@ -0,0 +1,9 @@ +import '../../base/test_base.dart'; +import '../../scenarios/email_detailed/display_email_with_xss_content_scenario.dart'; + +void main() { + TestBase().runPatrolTest( + description: 'Should not display alert dialog when opening an email containing content xss', + scenarioBuilder: ($) => DisplayEmailWithXssContentScenario($), + ); +} \ No newline at end of file