Merge pull request #4122 from alphagov/no-text-in-svg

Don’t allow <text> elements in letter logos

tests/app/main/views/test_letter_branding.py

@@ -2,6 +2,7 @@ from io import BytesIO
 from unittest.mock import Mock, call
 from uuid import UUID
 
+import pytest
 from botocore.exceptions import ClientError as BotoClientError
 from bs4 import BeautifulSoup
 from flask import url_for
@@ -348,29 +349,44 @@ def test_create_letter_branding_when_uploading_valid_file(
     assert mock_delete_temp_files.called is False
 
 
-def test_create_letter_branding_fails_validation_when_uploading_SVG_with_embedded_image(
+@pytest.mark.parametrize('svg_contents, expected_error', (
+    (
+        '''
+            <svg height="100" width="100">
+            <image href="someurlgoeshere" x="0" y="0" height="100" width="100"></image></svg>
+        ''',
+        'This SVG has an embedded raster image in it and will not render well',
+    ),
+    (
+        '''
+            <svg height="100" width="100">
+                <text>Will render differently depending on fonts installed</text>
+            </svg>
+        ''',
+        'This SVG has text which has not been converted to paths and may not render well',
+    ),
+))
+def test_create_letter_branding_fails_validation_when_uploading_SVG_with_bad_element(
     mocker,
-    platform_admin_client,
-    fake_uuid
+    client_request,
+    platform_admin_user,
+    fake_uuid,
+    svg_contents,
+    expected_error,
 ):
     filename = 'test.svg'
 
     mock_s3_upload = mocker.patch('app.s3_client.s3_logo_client.utils_s3upload')
 
-    response = platform_admin_client.post(
-        url_for('.create_letter_branding'),
-        data={'file': (BytesIO("""
-            <svg height="100" width="100">
-            <image href="someurlgoeshere" x="0" y="0" height="100" width="100"></image></svg>
-        """.encode('utf-8')), filename)},
-        follow_redirects=True,
+    client_request.login(platform_admin_user)
+    page = client_request.post(
+        '.create_letter_branding',
+        _data={'file': (BytesIO(svg_contents.encode('utf-8')), filename)},
+        _follow_redirects=True,
     )
 
-    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
-
     assert normalize_spaces(page.find('h1').text) == "Add letter branding"
-    message = 'This SVG has an embedded raster image in it and will not render well'
-    assert normalize_spaces(page.find("span", {"class": "error-message"}).text) == message
+    assert normalize_spaces(page.select_one(".error-message").text) == expected_error
 
     assert page.findAll('div', {'id': 'logo-img'}) == []