Simpletest should force check_plain (@url instead of !url) when outputting raw urls, as they can contain unencoded ampersands.

Comments

damien tournoud’s picture

Status: Needs review » Needs work

All those should be @xx, not only !url. It's a really bad habit to use !xx, even when you believe that what you are passing "cannot be anything other then plaintext" (you are generally wrong :p).

mr.baileys’s picture

Title: check_plain required when outputting url. » Improve simpletest HTTP request assertion message (checkplain + rewording)
Status: Needs work » Needs review
StatusFileSize
new1.43 KB

Let's meet halfway: !status should probably become @status because curl::getInfo returns a string. Even though HTTP Status codes should always be numeric, it doesn't hurt to be suspicous in this case.

When it comes to !method though, I don't think we should convert this to @ because I dare say this cannot be anything other than plaintext since it's populated by the following code:

'!method' => (empty($curl_options[CURLOPT_POSTFIELDS]) ? 'GET' : 'POST')

Same with !length: since the result of strlen is always numeric according to the docs (either 0 or number of characters), I think running this through check_plain is overkill.

<slightly off-topic>

I think "Always use @ unless you really really really know what you are doing" is a great rule, especially for newbies (and I still consider myself to be in that group). I do have two concerns with indiscriminently running check_plain though:

  1. Performance. If you have full control over the input, or if you completely trust the input (as in the case of !method above), you can save some cycles by skipping check_plain. Granted, in the grand scheme of things it probably doesn't improve performance much, but hey...
  2. Double check_plaining. Looking over the code for check_plain, it calls htmlspecialchars with the default value for double_encode which means encode everything, even if it already has been encoded. This way you run the risk of turning &amp; into &amp;amp;

</slightly off-topic>

While working on this I also decided the wording can be improved:

instead of '!method to !url, status is !status, !length is length bytes' I shortened it to '!method !url returned !status (!length bytes).' (shorter and more to the point)

Attached is a new patch with an additional @ on status and re-worded message, let me know what you think...

damien tournoud’s picture

Looks ok. While we are at it, could we properly use format_size() for the length?

mr.baileys’s picture

I debated whether or not format_size should be used. In this particular case I decided against it because I figured that the audience (testers, coders) of this type of messages (assertions) might want the exact byte count (12724 bytes instead of 12KB).

I wouldn't have a problem changing this if you still think this is better though.

damien tournoud’s picture

The main use of this is to detect 0-byte page responses. I believe that it would be better with a format_size().

mr.baileys’s picture

StatusFileSize
new1.53 KB

Makes sense, updated the patch to use format_size.

The assertion now looks like this:

POST http://d7-patch/index.php?q=index.php&q=user returned 200 (3.87 KB)

dries’s picture

Status: Needs review » Fixed

Looks like an improvement to me. Committed!

Status: Fixed » Closed (fixed)
Issue tags: -Quick fix, -Invalid markup

Automatically closed -- issue fixed for 2 weeks with no activity.