misc: check root element name when loading from xml storage (#68538)

tests/admin_pages/test_wscall.py

@@ -192,6 +192,13 @@ def test_wscalls_import(pub, wscall):
     resp = resp.form.submit()
     assert 'Invalid File' in resp.text
 
+    # import an xml of wrong type
+    resp = app.get('/backoffice/settings/wscalls/')
+    resp = resp.click(href='import')
+    resp.form['file'] = Upload('wscall.wcs', b'<hello/>')
+    resp = resp.form.submit()
+    assert 'Invalid File' in resp.text
+
 
 def test_wscalls_empty_param_values(pub):
     create_superuser(pub)

tests/api/test_export_import.py

@@ -267,8 +267,8 @@ def test_export_import_bundle_import(pub):
 
     data_source = NamedDataSource(name='Test')
     data_source.store()
-    category = DataSourceCategory(name='Test')
-    category.store()
+    ds_category = DataSourceCategory(name='Test')
+    ds_category.store()
 
     mail_template = MailTemplate(name='Test')
     mail_template.store()
@@ -281,7 +281,7 @@ def test_export_import_bundle_import(pub):
         ('workflows/test', workflow),
         ('forms-categories/test', category),
         ('data-sources/test', data_source),
-        ('data-sources-categories/test', category),
+        ('data-sources-categories/test', ds_category),
         ('mail-templates/test', mail_template),
         ('mail-templates-categories/test', mail_template_category),
     )

wcs/qommon/xml_storage.py

@@ -102,6 +102,10 @@ class XmlStorableObject(StorableObject):
         if not ET.iselement(tree):
             tree = tree.getroot()
 
+        if tree.tag not in (cls.xml_root_node, cls._names):
+            # note: cls._names is allowed for compatibility with legacy files.
+            raise ValueError('root element mismatch (%s vs %s)' % (tree.tag, cls.xml_root_node))
+
         if include_id and tree.attrib.get('id'):
             obj.id = tree.attrib.get('id')