consul/grecia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix broken tags in JavaScript injection tests

Browse Source 
This was introduced in commit 5ecbe01d4, probably by accident while
copying a suggestion made in the pull request for that change [1]. This
broken tag introduces issues when sanitizing the HTML text with an HTML5
sanitizer, which we will start using in a couple of commits.

[1] https://github.com/consuldemocracy/consuldemocracy/pull/462#issuecomment-139309289
This commit is contained in:
Javi Martín
2024-04-15 18:36:48 +02:00
parent 82c3c6646d
commit 8dcf66886e
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spec/system/comments_spec.rb
View File

@@ -267,7 +267,7 @@ describe "Comments" do
scenario "Sanitizes comment body for security" do scenario "Sanitizes comment body for security" do
create(:comment, commentable: resource, create(:comment, commentable: resource,
body: "<script>alert('hola')</script> " \ body: "<script>alert('hola')</script> " \
"<a href=\"javascript:alert('sorpresa!')\">click me<a/> " \ "<a href=\"javascript:alert('sorpresa!')\">click me</a> " \
"http://www.url.com") "http://www.url.com")
visit polymorphic_path(resource) visit polymorphic_path(resource)

2
spec/system/debates_spec.rb
View File

@@ -296,7 +296,7 @@ describe "Debates" do
scenario "JS injection is prevented but autolinking is respected", :no_js do scenario "JS injection is prevented but autolinking is respected", :no_js do
author = create(:user) author = create(:user)
js_injection_string = "<script>alert('hey')</script> " \ js_injection_string = "<script>alert('hey')</script> " \
"<a href=\"javascript:alert('surprise!')\">click me<a/> " \ "<a href=\"javascript:alert('surprise!')\">click me</a> " \
"http://example.org" "http://example.org"
login_as(author) login_as(author)

2
spec/system/proposals_spec.rb
View File

@@ -514,7 +514,7 @@ describe "Proposals" do
scenario "JS injection is prevented but autolinking is respected", :no_js do scenario "JS injection is prevented but autolinking is respected", :no_js do
author = create(:user) author = create(:user)
js_injection_string = "<script>alert('hey')</script> " \ js_injection_string = "<script>alert('hey')</script> " \
"<a href=\"javascript:alert('surprise!')\">click me<a/> " \ "<a href=\"javascript:alert('surprise!')\">click me</a> " \
"http://example.org" "http://example.org"
login_as(author) login_as(author)