Fix broken tags in JavaScript injection tests
This was introduced in commit 5ecbe01d4, probably by accident while
copying a suggestion made in the pull request for that change [1]. This
broken tag introduces issues when sanitizing the HTML text with an HTML5
sanitizer, which we will start using in a couple of commits.
[1] https://github.com/consuldemocracy/consuldemocracy/pull/462#issuecomment-139309289
This commit is contained in:
@@ -267,7 +267,7 @@ describe "Comments" do
|
||||
scenario "Sanitizes comment body for security" do
|
||||
create(:comment, commentable: resource,
|
||||
body: "<script>alert('hola')</script> " \
|
||||
"<a href=\"javascript:alert('sorpresa!')\">click me<a/> " \
|
||||
"<a href=\"javascript:alert('sorpresa!')\">click me</a> " \
|
||||
"http://www.url.com")
|
||||
|
||||
visit polymorphic_path(resource)
|
||||
|
||||
@@ -296,7 +296,7 @@ describe "Debates" do
|
||||
scenario "JS injection is prevented but autolinking is respected", :no_js do
|
||||
author = create(:user)
|
||||
js_injection_string = "<script>alert('hey')</script> " \
|
||||
"<a href=\"javascript:alert('surprise!')\">click me<a/> " \
|
||||
"<a href=\"javascript:alert('surprise!')\">click me</a> " \
|
||||
"http://example.org"
|
||||
login_as(author)
|
||||
|
||||
|
||||
@@ -514,7 +514,7 @@ describe "Proposals" do
|
||||
scenario "JS injection is prevented but autolinking is respected", :no_js do
|
||||
author = create(:user)
|
||||
js_injection_string = "<script>alert('hey')</script> " \
|
||||
"<a href=\"javascript:alert('surprise!')\">click me<a/> " \
|
||||
"<a href=\"javascript:alert('surprise!')\">click me</a> " \
|
||||
"http://example.org"
|
||||
login_as(author)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user