commit 2895fd6ddcae6c90b53efeaf9f56e9cc0e748689 from: Alisdair MacLeod via: Alisdair MacLeod <131350026+admacleod@users.noreply.github.com> date: Wed Mar 25 16:33:41 2026 UTC Add 12 missing integration test cases Cover previously untested code paths: routing catch-all (unknown routes, wrong methods), missing CSRF cookie (vs mismatch), missing day parameter in cancel form, empty request body on book, cancel of non-existent booking, past-booking filtering on the bookings page, empty day query parameter on dateform, no-desks-configured edge case on bookingform, and HTML escaping of desk names and usernames to guard against XSS regressions. Co-Authored-By: Claude Opus 4.6 (1M context) commit - c64c0d1524ca88914520c823d244c150e24926dc commit + 2895fd6ddcae6c90b53efeaf9f56e9cc0e748689 blob - /dev/null blob + 41be915dcc8a20f4be322d828dd23126b846ce98 (mode 644) --- /dev/null +++ test/book-error-csrf-missing.test @@ -0,0 +1,24 @@ +Book page errors when the CSRF cookie is absent. +--- +foo +bar +--- +baz@example.com,bar,2200-01-01 +baz@example.com,foo,2200-01-02 +--- +SERVER_PROTOCOL=HTTP/1.1 +REQUEST_URI=/book/2200-01-03 +REQUEST_METHOD=POST +REMOTE_USER=baz@example.com +CONTENT_TYPE=application/x-www-form-urlencoded +CONTENT_LENGTH=19 +--- +_csrf=qux&desk=foo +--- +baz@example.com,bar,2200-01-01 +baz@example.com,foo,2200-01-02 +--- +Status: 403 Forbidden +Content-Type: text/plain; charset=utf-8 + +Forbidden blob - /dev/null blob + 42ffdb5b43496288c4cc3fc3feb6d213f50b30c5 (mode 644) --- /dev/null +++ test/book-error-nobody.test @@ -0,0 +1,25 @@ +Book page errors when the request body is empty. +--- +foo +bar +--- +baz@example.com,bar,2200-01-01 +baz@example.com,foo,2200-01-02 +--- +SERVER_PROTOCOL=HTTP/1.1 +REQUEST_URI=/book/2200-01-03 +REQUEST_METHOD=POST +REMOTE_USER=baz@example.com +HTTP_COOKIE=deskd_csrf=qux +CONTENT_TYPE=application/x-www-form-urlencoded +CONTENT_LENGTH=0 +--- + +--- +baz@example.com,bar,2200-01-01 +baz@example.com,foo,2200-01-02 +--- +Status: 400 Bad Request +Content-Type: text/plain; charset=utf-8 + +Bad Request blob - /dev/null blob + 3ac1ba532e97f163d1dbdc55da35888750fa85b3 (mode 644) --- /dev/null +++ test/bookingform-html-escape.test @@ -0,0 +1,62 @@ +Booking form page HTML-escapes desk names and usernames. +--- +desk +a&b +--- +evil@