Merge pull request #1969 from alphagov/no-free-text-from-url

Don’t populate support form with arbitrary text

tests/app/main/views/test_feedback.py

@@ -7,6 +7,7 @@ from flask import url_for
 from freezegun import freeze_time
 from notifications_utils.clients import DeskproError
 from tests.conftest import (
+    active_user_with_permissions,
     mock_get_services,
     mock_get_services_with_no_services,
     mock_get_services_with_one_service,
@@ -85,29 +86,56 @@ def test_get_feedback_page(client, ticket_type, expected_status_code):
     assert response.status_code == expected_status_code
 
 
+@pytest.mark.parametrize('prefilled_body, expected_textarea', [
+    (
+        'agreement',
+        (
+            'Please send me a copy of the GOV.UK Notify data sharing '
+            'and financial agreement.'
+        )
+    ),
+    (
+        'agreement-with-owner',
+        (
+            'Please send me a copy of the GOV.UK Notify data sharing '
+            'and financial agreement for Marine Management '
+            'Organisation to sign.'
+        )
+    ),
+    (
+        'foo',
+        ''
+    ),
+])
 @freeze_time('2016-12-12 12:00:00.000000')
 def test_get_feedback_page_with_prefilled_body(
     client_request,
     mocker,
+    fake_uuid,
+    prefilled_body,
+    expected_textarea,
 ):
+    user = active_user_with_permissions(fake_uuid)
+    user.email_address = 'test@marinemanagement.org.uk'
+    mocker.patch('app.user_api_client.get_user', return_value=user)
     mock_post = mocker.patch('app.main.views.feedback.deskpro_client.create_ticket')
     page = client_request.get(
         'main.feedback',
         ticket_type=QUESTION_TICKET_TYPE,
-        body='Please send cat pictures <script>alert("foo");</script>',
+        body=prefilled_body,
     )
     assert page.select_one('textarea').text == (
-        'Please send cat pictures <script>alert("foo");</script>'
+        expected_textarea
     )
     client_request.post(
         'main.feedback',
         ticket_type=QUESTION_TICKET_TYPE,
-        body='Please send cat pictures <script>alert("foo");</script>',
+        body='agreement',
         _data={'feedback': 'blah', 'name': 'Example', 'email_address': 'test@example.com'}
     )
     message = mock_post.call_args[1]['message']
     assert message.endswith('blah')
-    assert 'cat pictures' not in message
+    assert 'Please send' not in message
 
 
 @freeze_time('2016-12-12 12:00:00.000000')