From 8dcf66886e15bf0f5327d5a42bc8446c3e0bd850 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Javi=20Mart=C3=ADn?= <javim@elretirao.net>
Date: Mon, 15 Apr 2024 18:36:48 +0200
Subject: [PATCH] Fix broken tags in JavaScript injection tests

This was introduced in commit 5ecbe01d4, probably by accident while
copying a suggestion made in the pull request for that change [1]. This
broken tag introduces issues when sanitizing the HTML text with an HTML5
sanitizer, which we will start using in a couple of commits.

[1] https://github.com/consuldemocracy/consuldemocracy/pull/462#issuecomment-139309289
---
 spec/system/comments_spec.rb  | 2 +-
 spec/system/debates_spec.rb   | 2 +-
 spec/system/proposals_spec.rb | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/spec/system/comments_spec.rb b/spec/system/comments_spec.rb
index a5676fd3c..a20ce20a3 100644
--- a/spec/system/comments_spec.rb
+++ b/spec/system/comments_spec.rb
@@ -267,7 +267,7 @@ describe "Comments" do
   scenario "Sanitizes comment body for security" do
     create(:comment, commentable: resource,
                      body: "<script>alert('hola')</script> " \
-                           "<a href=\"javascript:alert('sorpresa!')\">click me<a/> " \
+                           "<a href=\"javascript:alert('sorpresa!')\">click me</a> " \
                            "http://www.url.com")
 
     visit polymorphic_path(resource)
diff --git a/spec/system/debates_spec.rb b/spec/system/debates_spec.rb
index 2e4d49bb7..9604e4e59 100644
--- a/spec/system/debates_spec.rb
+++ b/spec/system/debates_spec.rb
@@ -296,7 +296,7 @@ describe "Debates" do
   scenario "JS injection is prevented but autolinking is respected", :no_js do
     author = create(:user)
     js_injection_string = "<script>alert('hey')</script> " \
-                          "<a href=\"javascript:alert('surprise!')\">click me<a/> " \
+                          "<a href=\"javascript:alert('surprise!')\">click me</a> " \
                           "http://example.org"
     login_as(author)
 
diff --git a/spec/system/proposals_spec.rb b/spec/system/proposals_spec.rb
index dc9912e05..77f2ad1c3 100644
--- a/spec/system/proposals_spec.rb
+++ b/spec/system/proposals_spec.rb
@@ -514,7 +514,7 @@ describe "Proposals" do
   scenario "JS injection is prevented but autolinking is respected", :no_js do
     author = create(:user)
     js_injection_string = "<script>alert('hey')</script> " \
-                          "<a href=\"javascript:alert('surprise!')\">click me<a/> " \
+                          "<a href=\"javascript:alert('surprise!')\">click me</a> " \
                           "http://example.org"
     login_as(author)