Unit test code installed in deployment

[Dave McCowan]

It is Horizon's (and OpenStack's) practice to not install unit test code as part of deployment.
It is also a security best practice to not install and expose test code to a end users of a deployment.

Using the AppScan test suite, it was found that:

GET /dashboard/i18n/js/horizon%2Bopenstack_dashboard/test/

returns the javscript that matches this file:

https://github.com/django/django/blob/3c447b108ac70757001171f7a4791f493880bf5b/js_tests/admin/jsi18n-mocks.test.js

Expected behavior: this javascript intended for unit test should not be part of the installed software and should not be executable by an end user of the deployment.

[Rob Cresswell (robcresswell-deactivatedaccount)]

It's actually rendering out https://github.com/openstack/horizon/blob/c66a1a14c5ac2a70843eec04e83c68e4b761b89e/test-shim.js which is a copy of the above Django file.

As far as I understand it, this provides a workaround for global gettext in JS-land, which should really be done via dependency injection. This is actually possible in the code base now, but isn't enforced.