User/grant archibald ms/report 594

[Grant-Archibald-MS]

Pull Request Template

Description

Add new test summary option to Test Engine. This feature provides the following:

• New --run-name that allows a common test run name to be applied to multiple test execution sessions.
• New --output-file that allows the name of the HTL summary report to be specified

$env:user1Email = "test@contoso.onmicrosoft.com"
dotnet PowerAppsTestEngine -i test.te.yaml -p mda -e $envId -t $tenantId -d $testPage --run-name "Sample"
dotnet PowerAppsTestEngine -i test2.te.yaml -p mda -e $envId -t $tenantId -d $testPage --run-name "Sample"

$folderPath = "$env:USERPROFILE\AppData\Local\Temp\Microsoft\TestEngine\TestOutput"
$reportPath = [System.IO.Path]::Combine($folderPath, "test_summary_$runName.html")

dotnet PowerAppsTestEngine  --run-name "Sample" --output-file $reportPath

Checklist

• The code change is covered by unit tests. I have added tests that prove my fix is effective or that my feature works
• I have performed end-to-end test locally.
• New and existing unit tests pass locally with my changes
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I used clear names for everything
• I have performed a self-review of my own code

To fix the issue, the text retrieved from relatedBtn.textContent should be properly escaped before being interpolated into the HTML string. Escaping ensures that any meta-characters in the text are treated as literal text rather than HTML. A utility function or library like DOMPurify can be used for this purpose, or a simple manual escaping function can be implemented.

Steps to fix:

1. Introduce a function to escape HTML meta-characters (e.g., <, >, &, ").
2. Use this function to sanitize relatedBtn.textContent before interpolating it into the HTML string.
3. Replace the vulnerable line with the sanitized version.

---

To fix the issue, the value of videoSrc should be validated or sanitized before being assigned to the src property of the <source> element. A simple and effective approach is to ensure that videoSrc is a valid and safe URL. This can be achieved using the URL constructor, which throws an error if the input is not a valid URL. Additionally, you can restrict the allowed protocols (e.g., http and https) to prevent malicious payloads.

The fix involves:

1. Wrapping the assignment of videoSrc in a validation step.
2. Using the URL constructor to validate the URL and checking its protocol.
3. Logging an error and skipping the assignment if the validation fails.

---

[Grant-Archibald-MS]

Extended the Copilot Studio Kit sample to include the following

• validate.ps1 - To validate that dependencies for source code version of Test Engine are configured as expected and ready to run the sample
• RunTests.ps1 to run a set of tests with pac test run or from the source code version