|
- - {% blocktrans trimmed asvar tmsg %} - We hope you're enjoying {start_strong}{course_name}{end_strong}! - We want to let you know what you can look forward to in week {week_num}: - {% endblocktrans %} - {% interpolate_html tmsg start_strong=''|safe end_strong=''|safe course_name=course_name|force_escape|safe week_num=week_num|force_escape|safe %} -
{% filter force_escape %}
- {% blocktrans trimmed %}
- With self-paced courses, you learn on your own schedule.
- We encourage you to spend time with the course each week.
- Your focused attention will pay off in the end!
- {% endblocktrans %}
+ {% blocktrans %}This is a routed Account Activation email for {{ routed_profile_name }} ({{ routed_user_email }}): {{ routed_profile_name }}{% endblocktrans %}
{% endfilter %}
+ |
||
|
+ |
+||
|
+ + {% trans "We hope you’re enjoying Introduction to Data Science with Python!" as tmsg %}{{ tmsg | force_escape }} + ++ {% trans "We want to let you know what you can look forward to in week two: " as tmsg %}{{ tmsg | force_escape }} + +
|
+||
| + {% filter force_escape %} + {% blocktrans asvar course_cta_text %}Resume your course {% endblocktrans %} + {% endfilter %} + {% include "schedules/edx_ace/courseupdate/email/return_to_course_cta.html" with course_cta_text=course_cta_text%} + | +||
| + + | +||
+
|
+
+
+
|
+
+ 
+ 
+ 
+ 
+ 
+
|
+
+ {# email client support for style sheets is pretty spotty, so we have to inline all of these styles #} + 1 %} + href="{% with_link_tracking dashboard_url %}" + {% else %} + href="{% with_link_tracking course_url %}" + {% endif %} + {% endif %} + style=" + text-decoration: none; + color: white; + background-color: #ED5C13; + text-align: center; + vertical-align: middle; + user-select: none; + font-weight: 500; + font-size: 12px; + text-decoration-style: solid; + display: inline-flex; + flex-direction: row; + border-radius: 30.22px; + "> + {# old email clients require the use of the font tag :( #} + {{ course_cta_text }} + +
diff --git a/openedx/core/djangoapps/schedules/tests/test_resolvers.py b/openedx/core/djangoapps/schedules/tests/test_resolvers.py index a23c9dbb21..2c37608e5c 100644 --- a/openedx/core/djangoapps/schedules/tests/test_resolvers.py +++ b/openedx/core/djangoapps/schedules/tests/test_resolvers.py @@ -271,6 +271,8 @@ class TestCourseNextSectionUpdateResolver(SchedulesResolverTestMixin, ModuleStor @override_settings(CONTACT_MAILING_ADDRESS='123 Sesame Street') @override_settings(LOGO_URL_PNG='https://www.logo.png') + @override_settings(SELF_PACED_BANNER_URL='') + @override_settings(SELF_PACED_CLOUD_URL='') def test_schedule_context(self): resolver = self.create_resolver() # using this to make sure the select_related stays intact @@ -316,6 +318,8 @@ class TestCourseNextSectionUpdateResolver(SchedulesResolverTestMixin, ModuleStor 'twitter': twitter_url}, 'template_revision': 'release', 'unsubscribe_url': None, + 'self_paced_banner_url': '', + 'self_paced_cloud_url': '', 'week_highlights': ['good stuff 2'], 'week_num': 2, } diff --git a/openedx/core/djangoapps/user_api/accounts/tests/test_views.py b/openedx/core/djangoapps/user_api/accounts/tests/test_views.py index 1c92aa22c7..466e1e278a 100644 --- a/openedx/core/djangoapps/user_api/accounts/tests/test_views.py +++ b/openedx/core/djangoapps/user_api/accounts/tests/test_views.py @@ -403,17 +403,18 @@ class TestAccountsAPI(FilteredQueryCountMixin, CacheIsolationTestCase, UserAPITe assert data['social_links'] is not None assert data['time_zone'] is None - def _verify_private_account_response(self, response, requires_parental_consent=False): + def _verify_private_account_response(self, response, requires_parental_consent=False, has_profile_image=True): """ Verify that only the public fields are returned if a user does not want to share account fields """ data = response.data assert 3 == len(data) assert PRIVATE_VISIBILITY == data['account_privacy'] - self._verify_profile_image_data(data, not requires_parental_consent) + self._verify_profile_image_data(data, has_profile_image) assert self.user.username == data['username'] - def _verify_full_account_response(self, response, requires_parental_consent=False, year_of_birth=2000): + def _verify_full_account_response(self, response, requires_parental_consent=False, + has_profile_image=True, year_of_birth=2000): """ Verify that all account fields are returned (even those that are not shareable). """ @@ -426,7 +427,7 @@ class TestAccountsAPI(FilteredQueryCountMixin, CacheIsolationTestCase, UserAPITe UserPreference.get_value(self.user, 'account_privacy') ) assert expected_account_privacy == data['account_privacy'] - self._verify_profile_image_data(data, not requires_parental_consent) + self._verify_profile_image_data(data, has_profile_image) assert self.user.username == data['username'] # additional shareable fields (8) @@ -1271,11 +1272,11 @@ class TestAccountsAPI(FilteredQueryCountMixin, CacheIsolationTestCase, UserAPITe assert data['requires_parental_consent'] assert PRIVATE_VISIBILITY == data['account_privacy'] else: - self._verify_private_account_response(response, requires_parental_consent=True) + self._verify_private_account_response(response, requires_parental_consent=True, has_profile_image=False) # Verify that the shared view is still private response = self.send_get(client, query_parameters='view=shared') - self._verify_private_account_response(response, requires_parental_consent=True) + self._verify_private_account_response(response, requires_parental_consent=True, has_profile_image=False) @skip_unless_lms diff --git a/openedx/core/djangoapps/user_authn/tests/test_cookies.py b/openedx/core/djangoapps/user_authn/tests/test_cookies.py index d4d9a59fc9..aa2e687102 100644 --- a/openedx/core/djangoapps/user_authn/tests/test_cookies.py +++ b/openedx/core/djangoapps/user_authn/tests/test_cookies.py @@ -1,8 +1,9 @@ # pylint: disable=missing-docstring -from datetime import date +from datetime import date, datetime import json +from pytz import UTC from unittest.mock import MagicMock, patch from urllib.parse import urljoin from django.conf import settings @@ -20,6 +21,10 @@ from common.djangoapps.student.tests.factories import AnonymousUserFactory, User from openedx.core.djangoapps.profile_images.tests.helpers import make_image_file from openedx.core.djangoapps.profile_images.images import create_profile_images from openedx.core.djangoapps.user_api.accounts.image_helpers import get_profile_image_names +from openedx.core.djangoapps.user_api.accounts.image_helpers import get_profile_image_urls_for_user + + +TEST_PROFILE_IMAGE_UPLOAD_DT = datetime(2002, 1, 9, 15, 43, 1, tzinfo=UTC) class CookieTests(TestCase): @@ -27,6 +32,8 @@ class CookieTests(TestCase): super().setUp() self.user = UserFactory.create() self.user.profile = UserProfileFactory.create(user=self.user) + self.user.profile.profile_image_uploaded_at = TEST_PROFILE_IMAGE_UPLOAD_DT + self.user.profile.save() # lint-amnesty, pylint: disable=no-member self.request = RequestFactory().get('/') self.request.user = self.user self.request.session = self._get_stub_session() @@ -43,18 +50,6 @@ class CookieTests(TestCase): return urls_obj - def _get_expected_image_urls(self): - expected_image_urls = { - 'full': '/static/default_500.png', - 'large': '/static/default_120.png', - 'medium': '/static/default_50.png', - 'small': '/static/default_30.png' - } - - expected_image_urls = self._convert_to_absolute_uris(self.request, expected_image_urls) - - return expected_image_urls - def _get_expected_header_urls(self): expected_header_urls = { 'logout': reverse('logout'), @@ -112,7 +107,7 @@ class CookieTests(TestCase): 'username': self.user.username, 'email': self.user.email, 'header_urls': self._get_expected_header_urls(), - 'user_image_urls': self._get_expected_image_urls(), + 'user_image_urls': get_profile_image_urls_for_user(self.user), } self.assertDictEqual(actual, expected) diff --git a/openedx/core/lib/jwt.py b/openedx/core/lib/jwt.py index 47642b8695..199c6fead8 100644 --- a/openedx/core/lib/jwt.py +++ b/openedx/core/lib/jwt.py @@ -2,12 +2,12 @@ JWT Token handling and signing functions. """ -import json +import jwt from time import time from django.conf import settings -from jwkest import Expired, Invalid, MissingKey, jwk -from jwkest.jws import JWS +from jwt.api_jwk import PyJWK, PyJWKSet +from jwt.exceptions import ExpiredSignatureError, InvalidSignatureError, MissingRequiredClaimError def create_jwt(lms_user_id, expires_in_seconds, additional_token_claims, now=None): @@ -40,15 +40,9 @@ def _encode_and_sign(payload): The signing key and algorithm are pulled from settings. """ - keys = jwk.KEYS() - - serialized_keypair = json.loads(settings.TOKEN_SIGNING['JWT_PRIVATE_SIGNING_JWK']) - keys.add(serialized_keypair) + private_key = PyJWK.from_json(settings.TOKEN_SIGNING['JWT_PRIVATE_SIGNING_JWK']) algorithm = settings.TOKEN_SIGNING['JWT_SIGNING_ALGORITHM'] - - data = json.dumps(payload) - jws = JWS(data, alg=algorithm) - return jws.sign_compact(keys=keys) + return jwt.encode(payload, key=private_key.key, algorithm=algorithm) def unpack_jwt(token, lms_user_id, now=None): @@ -65,27 +59,40 @@ def unpack_jwt(token, lms_user_id, now=None): Returns a valid, decoded json payload (string). """ now = now or int(time()) - payload = _unpack_and_verify(token) + payload = unpack_and_verify(token) if "lms_user_id" not in payload: - raise MissingKey("LMS user id is missing") + raise MissingRequiredClaimError("LMS user id is missing") if "exp" not in payload: - raise MissingKey("Expiration is missing") + raise MissingRequiredClaimError("Expiration is missing") if payload["lms_user_id"] != lms_user_id: - raise Invalid("User does not match") + raise InvalidSignatureError("User does not match") if payload["exp"] < now: - raise Expired("Token is expired") + raise ExpiredSignatureError("Token is expired") return payload -def _unpack_and_verify(token): +def unpack_and_verify(token): # pylint: disable=inconsistent-return-statements """ Unpack and verify the provided token. The signing key and algorithm are pulled from settings. """ - keys = jwk.KEYS() - keys.load_jwks(settings.TOKEN_SIGNING['JWT_PUBLIC_SIGNING_JWK_SET']) - decoded = JWS().verify_compact(token.encode('utf-8'), keys) - return decoded + key_set = [] + key_set.extend( + PyJWKSet.from_json(settings.TOKEN_SIGNING["JWT_PUBLIC_SIGNING_JWK_SET"]).keys + ) + + for i in range(len(key_set)): # pylint: disable=consider-using-enumerate + try: + decoded = jwt.decode( + token, + key=key_set[i].key, + algorithms=["RS256", "RS512"], + options={"verify_signature": True, "verify_aud": False}, + ) + return decoded + except Exception: # pylint: disable=broad-exception-caught + if i == len(key_set) - 1: + raise diff --git a/openedx/core/lib/tests/test_jwt.py b/openedx/core/lib/tests/test_jwt.py index 7a678dd3c0..da1f047e48 100644 --- a/openedx/core/lib/tests/test_jwt.py +++ b/openedx/core/lib/tests/test_jwt.py @@ -2,24 +2,23 @@ Tests for token handling """ import unittest +from time import time -from django.conf import settings -from jwkest import BadSignature, Expired, Invalid, MissingKey, jwk -from jwkest.jws import JWS +from jwt.exceptions import ExpiredSignatureError, InvalidSignatureError, MissingRequiredClaimError from openedx.core.djangolib.testing.utils import skip_unless_lms -from openedx.core.lib.jwt import _encode_and_sign, create_jwt, unpack_jwt +from openedx.core.lib.jwt import _encode_and_sign, create_jwt, unpack_jwt, unpack_and_verify test_user_id = 121 invalid_test_user_id = 120 -test_timeout = 60 -test_now = 1661432902 +test_timeout = 1000 +test_now = int(time()) test_claims = {"foo": "bar", "baz": "quux", "meaning": 42} expected_full_token = { "lms_user_id": test_user_id, - "iat": 1661432902, - "exp": 1661432902 + 60, + "iat": test_now, + "exp": test_now + test_timeout, "iss": "token-test-issuer", # these lines from test_settings.py "version": "1.2.0", # these lines from test_settings.py } @@ -34,7 +33,7 @@ class TestSign(unittest.TestCase): def test_create_jwt(self): token = create_jwt(test_user_id, test_timeout, {}, test_now) - decoded = _verify_jwt(token) + decoded = unpack_and_verify(token) self.assertEqual(expected_full_token, decoded) def test_create_jwt_with_claims(self): @@ -43,7 +42,7 @@ class TestSign(unittest.TestCase): expected_token_with_claims = expected_full_token.copy() expected_token_with_claims.update(test_claims) - decoded = _verify_jwt(token) + decoded = unpack_and_verify(token) self.assertEqual(expected_token_with_claims, decoded) def test_malformed_token(self): @@ -53,19 +52,8 @@ class TestSign(unittest.TestCase): expected_token_with_claims = expected_full_token.copy() expected_token_with_claims.update(test_claims) - with self.assertRaises(BadSignature): - _verify_jwt(token) - - -def _verify_jwt(jwt_token): - """ - Helper function which verifies the signature and decodes the token - from string back to claims form - """ - keys = jwk.KEYS() - keys.load_jwks(settings.TOKEN_SIGNING['JWT_PUBLIC_SIGNING_JWK_SET']) - decoded = JWS().verify_compact(jwt_token.encode('utf-8'), keys) - return decoded + with self.assertRaises(InvalidSignatureError): + unpack_and_verify(token) @skip_unless_lms @@ -97,19 +85,19 @@ class TestUnpack(unittest.TestCase): expected_token_with_claims = expected_full_token.copy() expected_token_with_claims.update(test_claims) - with self.assertRaises(BadSignature): + with self.assertRaises(InvalidSignatureError): unpack_jwt(token, test_user_id, test_now) def test_unpack_token_with_invalid_user(self): token = create_jwt(invalid_test_user_id, test_timeout, {}, test_now) - with self.assertRaises(Invalid): + with self.assertRaises(InvalidSignatureError): unpack_jwt(token, test_user_id, test_now) def test_unpack_expired_token(self): token = create_jwt(test_user_id, test_timeout, {}, test_now) - with self.assertRaises(Expired): + with self.assertRaises(ExpiredSignatureError): unpack_jwt(token, test_user_id, test_now + test_timeout + 1) def test_missing_expired_lms_user_id(self): @@ -117,7 +105,7 @@ class TestUnpack(unittest.TestCase): del payload['lms_user_id'] token = _encode_and_sign(payload) - with self.assertRaises(MissingKey): + with self.assertRaises(MissingRequiredClaimError): unpack_jwt(token, test_user_id, test_now) def test_missing_expired_key(self): @@ -125,5 +113,5 @@ class TestUnpack(unittest.TestCase): del payload['exp'] token = _encode_and_sign(payload) - with self.assertRaises(MissingKey): + with self.assertRaises(MissingRequiredClaimError): unpack_jwt(token, test_user_id, test_now) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 0b1bb96a59..260ec2bb81 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -51,7 +51,7 @@ django-stubs<6 # The team that owns this package will manually bump this package rather than having it pulled in automatically. # This is to allow them to better control its deployment and to do it in a process that works better # for them. -edx-enterprise==6.0.3 +edx-enterprise==6.2.5 # Date: 2023-07-26 # Our legacy Sass code is incompatible with anything except this ancient libsass version. diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt index f800d10a2d..c1809ae42d 100644 --- a/requirements/edx/base.txt +++ b/requirements/edx/base.txt @@ -421,7 +421,7 @@ edx-celeryutils==1.4.0 # -r requirements/edx/kernel.in # edx-name-affirmation # super-csv -edx-codejail==3.5.2 +edx-codejail==4.0.0 # via -r requirements/edx/kernel.in edx-completion==4.9 # via -r requirements/edx/kernel.in @@ -461,7 +461,7 @@ edx-drf-extensions==10.6.0 # edx-when # edxval # openedx-learning -edx-enterprise==6.0.3 +edx-enterprise==6.2.5 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt index c49f64a635..b928da2b66 100644 --- a/requirements/edx/development.txt +++ b/requirements/edx/development.txt @@ -691,7 +691,7 @@ edx-celeryutils==1.4.0 # -r requirements/edx/testing.txt # edx-name-affirmation # super-csv -edx-codejail==3.5.2 +edx-codejail==4.0.0 # via # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt @@ -740,7 +740,7 @@ edx-drf-extensions==10.6.0 # edx-when # edxval # openedx-learning -edx-enterprise==6.0.3 +edx-enterprise==6.2.5 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt index 71adb423f6..b5413f24f4 100644 --- a/requirements/edx/doc.txt +++ b/requirements/edx/doc.txt @@ -505,7 +505,7 @@ edx-celeryutils==1.4.0 # -r requirements/edx/base.txt # edx-name-affirmation # super-csv -edx-codejail==3.5.2 +edx-codejail==4.0.0 # via -r requirements/edx/base.txt edx-completion==4.9 # via -r requirements/edx/base.txt @@ -545,7 +545,7 @@ edx-drf-extensions==10.6.0 # edx-when # edxval # openedx-learning -edx-enterprise==6.0.3 +edx-enterprise==6.2.5 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt diff --git a/requirements/edx/kernel.in b/requirements/edx/kernel.in index caec5c8c04..fcc502755c 100644 --- a/requirements/edx/kernel.in +++ b/requirements/edx/kernel.in @@ -66,7 +66,8 @@ edx-celeryutils edx-completion edx-django-release-util # Release utils for the edx release pipeline edx-django-sites-extensions -edx-codejail +# Codejail 4 brings important safety improvements (no unsafe mode by default) +edx-codejail>=4.0.0 # edx-django-utils 5.14.1 adds FrontendMonitoringMiddleware edx-django-utils>=5.14.1 # Utilities for cache, monitoring, and plugins edx-drf-extensions diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt index 16ba8528f5..8e0301ac7e 100644 --- a/requirements/edx/testing.txt +++ b/requirements/edx/testing.txt @@ -530,7 +530,7 @@ edx-celeryutils==1.4.0 # -r requirements/edx/base.txt # edx-name-affirmation # super-csv -edx-codejail==3.5.2 +edx-codejail==4.0.0 # via -r requirements/edx/base.txt edx-completion==4.9 # via -r requirements/edx/base.txt @@ -570,7 +570,7 @@ edx-drf-extensions==10.6.0 # edx-when # edxval # openedx-learning -edx-enterprise==6.0.3 +edx-enterprise==6.2.5 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt diff --git a/xmodule/capa/safe_exec/tests/test_safe_exec.py b/xmodule/capa/safe_exec/tests/test_safe_exec.py index d09f8c9d9b..d7679b66aa 100644 --- a/xmodule/capa/safe_exec/tests/test_safe_exec.py +++ b/xmodule/capa/safe_exec/tests/test_safe_exec.py @@ -24,8 +24,10 @@ from openedx.core.djangolib.testing.utils import skip_unless_lms from xmodule.capa.safe_exec import safe_exec, update_hash from xmodule.capa.safe_exec.remote_exec import is_codejail_in_darklaunch, is_codejail_rest_service_enabled from xmodule.capa.safe_exec.safe_exec import emsg_normalizers, normalize_error_message +from xmodule.capa.tests.test_util import use_unsafe_codejail +@use_unsafe_codejail() class TestSafeExec(unittest.TestCase): # lint-amnesty, pylint: disable=missing-class-docstring def test_set_values(self): g = {} @@ -530,6 +532,7 @@ class DictCache(object): self.cache[key] = value +@use_unsafe_codejail() class TestSafeExecCaching(unittest.TestCase): """Test that caching works on safe_exec.""" @@ -654,6 +657,7 @@ class TestUpdateHash(unittest.TestCase): assert h1 == h2 +@use_unsafe_codejail() class TestRealProblems(unittest.TestCase): # lint-amnesty, pylint: disable=missing-class-docstring def test_802x(self): code = textwrap.dedent("""\ diff --git a/xmodule/capa/tests/test_capa_problem.py b/xmodule/capa/tests/test_capa_problem.py index 74cf4d096f..5f42b91849 100644 --- a/xmodule/capa/tests/test_capa_problem.py +++ b/xmodule/capa/tests/test_capa_problem.py @@ -15,6 +15,7 @@ from markupsafe import Markup from xmodule.capa.correctmap import CorrectMap from xmodule.capa.responsetypes import LoncapaProblemError from xmodule.capa.tests.helpers import new_loncapa_problem +from xmodule.capa.tests.test_util import use_unsafe_codejail from openedx.core.djangolib.markup import HTML @@ -23,6 +24,7 @@ FEATURES_WITH_GRADING_METHOD_IN_PROBLEMS['ENABLE_GRADING_METHOD_IN_PROBLEMS'] = @ddt.ddt +@use_unsafe_codejail() class CAPAProblemTest(unittest.TestCase): """ CAPA problem related tests""" @@ -424,6 +426,7 @@ class CAPAProblemTest(unittest.TestCase): @ddt.ddt +@use_unsafe_codejail() class CAPAMultiInputProblemTest(unittest.TestCase): """ TestCase for CAPA problems with multiple inputtypes """ diff --git a/xmodule/capa/tests/test_html_render.py b/xmodule/capa/tests/test_html_render.py index 0af5f1198e..46ad47d79a 100644 --- a/xmodule/capa/tests/test_html_render.py +++ b/xmodule/capa/tests/test_html_render.py @@ -11,12 +11,14 @@ from unittest import mock import ddt from lxml import etree from xmodule.capa.tests.helpers import new_loncapa_problem, mock_capa_system +from xmodule.capa.tests.test_util import use_unsafe_codejail from openedx.core.djangolib.markup import HTML from .response_xml_factory import CustomResponseXMLFactory, StringResponseXMLFactory @ddt.ddt +@use_unsafe_codejail() class CapaHtmlRenderTest(unittest.TestCase): """ CAPA HTML rendering tests class. diff --git a/xmodule/capa/tests/test_responsetypes.py b/xmodule/capa/tests/test_responsetypes.py index fa0c97fb15..ca9f5eba59 100644 --- a/xmodule/capa/tests/test_responsetypes.py +++ b/xmodule/capa/tests/test_responsetypes.py @@ -37,6 +37,7 @@ from xmodule.capa.tests.response_xml_factory import ( SymbolicResponseXMLFactory, TrueFalseResponseXMLFactory ) +from xmodule.capa.tests.test_util import use_unsafe_codejail from xmodule.capa.util import convert_files_to_filenames from xmodule.capa.xqueue_interface import dateformat @@ -108,6 +109,7 @@ class ResponseTest(unittest.TestCase): return str(rand.randint(0, 1e9)) +@use_unsafe_codejail() class MultiChoiceResponseTest(ResponseTest): # pylint: disable=missing-class-docstring xml_factory_class = MultipleChoiceResponseXMLFactory @@ -375,6 +377,7 @@ class SymbolicResponseTest(ResponseTest): # pylint: disable=missing-class-docst assert correct_map.get_correctness('1_2_1') == expected_correctness +@use_unsafe_codejail() class OptionResponseTest(ResponseTest): # pylint: disable=missing-class-docstring xml_factory_class = OptionResponseXMLFactory @@ -422,6 +425,7 @@ class OptionResponseTest(ResponseTest): # pylint: disable=missing-class-docstri assert correct_map.get_property('1_2_1', 'answervariable') == '$a' +@use_unsafe_codejail() class FormulaResponseTest(ResponseTest): """ Test the FormulaResponse class @@ -571,6 +575,7 @@ class FormulaResponseTest(ResponseTest): assert not list(problem.responders.values())[0].validate_answer('3*y+2*x') +@use_unsafe_codejail() class StringResponseTest(ResponseTest): # pylint: disable=missing-class-docstring xml_factory_class = StringResponseXMLFactory @@ -1124,6 +1129,7 @@ class CodeResponseTest(ResponseTest): # pylint: disable=missing-class-docstring assert output[answer_id]['msg'] == 'Invalid grader reply. Please contact the course staff.' +@use_unsafe_codejail() class ChoiceResponseTest(ResponseTest): # pylint: disable=missing-class-docstring xml_factory_class = ChoiceResponseXMLFactory @@ -1292,6 +1298,7 @@ class ChoiceResponseTest(ResponseTest): # pylint: disable=missing-class-docstri self.assert_grade(problem, ['choice_1', 'choice_3'], 'incorrect') +@use_unsafe_codejail() class NumericalResponseTest(ResponseTest): # pylint: disable=missing-class-docstring xml_factory_class = NumericalResponseXMLFactory @@ -1680,6 +1687,7 @@ class NumericalResponseTest(ResponseTest): # pylint: disable=missing-class-docs assert not responder.validate_answer('fish') +@use_unsafe_codejail() class CustomResponseTest(ResponseTest): # pylint: disable=missing-class-docstring xml_factory_class = CustomResponseXMLFactory @@ -2399,6 +2407,7 @@ class CustomResponseTest(ResponseTest): # pylint: disable=missing-class-docstri assert correct_map.get_msg('1_2_11') == '11' +@use_unsafe_codejail() class SchematicResponseTest(ResponseTest): """ Class containing setup and tests for Schematic responsetype. @@ -2488,6 +2497,7 @@ class AnnotationResponseTest(ResponseTest): # lint-amnesty, pylint: disable=mis assert expected_points == actual_points, ('%s should have %d points' % (answer_id, expected_points)) +@use_unsafe_codejail() class ChoiceTextResponseTest(ResponseTest): """ Class containing setup and tests for ChoiceText responsetype. diff --git a/xmodule/capa/tests/test_util.py b/xmodule/capa/tests/test_util.py index 92bc039cfa..3176ff9b9a 100644 --- a/xmodule/capa/tests/test_util.py +++ b/xmodule/capa/tests/test_util.py @@ -6,7 +6,9 @@ Tests capa util import unittest +import codejail.safe_exec import ddt +from django.test.utils import TestContextDecorator from lxml import etree from xmodule.capa.tests.helpers import mock_capa_system @@ -167,3 +169,28 @@ class UtilTest(unittest.TestCase): expected_text = '$あなたあなたあなたあなた あなたhi' contextual_text = contextualize_text(text, context) assert expected_text == contextual_text + + +class use_unsafe_codejail(TestContextDecorator): + """ + Tell codejail to run in unsafe mode for the scope of the decorator. + Use this as a decorator on Django TestCase classes or methods. + + This is needed because codejail has significant OS-level setup requirements + which we don't even attempt to fulfill for unit testing purposes. Running + tests in unsafe mode (that is, running code executions in-process, with no + sandboxing) is only safe because we control the contents of the unit tests. + It's not a perfect replica of how safe mode operates but it's generally good + enough for testing the integration and overall behavior. + """ + + def __init__(self): + self.old_be_unsafe = None + super().__init__() + + def enable(self): + self.old_be_unsafe = codejail.safe_exec.ALWAYS_BE_UNSAFE + codejail.safe_exec.ALWAYS_BE_UNSAFE = True + + def disable(self): + codejail.safe_exec.ALWAYS_BE_UNSAFE = self.old_be_unsafe diff --git a/xmodule/tests/test_capa_block.py b/xmodule/tests/test_capa_block.py index b48aa10ef8..21582e55ea 100644 --- a/xmodule/tests/test_capa_block.py +++ b/xmodule/tests/test_capa_block.py @@ -37,6 +37,7 @@ from xmodule.capa.responsetypes import LoncapaProblemError, ResponseError, Stude from xmodule.capa.xqueue_interface import XQueueInterface from xmodule.capa_block import ComplexEncoder, ProblemBlock from xmodule.tests import DATA_DIR +from xmodule.capa.tests.test_util import use_unsafe_codejail from ..capa_block import RANDOMIZATION, SHOWANSWER from . import get_test_system @@ -3635,6 +3636,7 @@ class ComplexEncoderTest(unittest.TestCase): # lint-amnesty, pylint: disable=mi @skip_unless_lms +@use_unsafe_codejail() class ProblemCheckTrackingTest(unittest.TestCase): """ Ensure correct tracking information is included in events emitted during problem checks.