| @@ -197,6 +197,13 EXPECTED | |||||
| 197 | assert_equal '<p>[msg1][msg2]</p>', to_html('[msg1][msg2]') |
|
197 | assert_equal '<p>[msg1][msg2]</p>', to_html('[msg1][msg2]') | |
| 198 | end |
|
198 | end | |
| 199 |
|
199 | |||
|
|
200 | def test_textile_should_escape_image_urls | |||
|
|
201 | # this is onclick="alert('XSS');" in encoded form | |||
|
|
202 | raw = '!/images/comment.png"onclick=alert('XSS');"!' | |||
|
|
203 | expected = '<p><img src="/images/comment.png"onclick=&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;;&#x22;" alt="" /></p>' | |||
|
|
204 | assert_equal expected.gsub(%r{\s+}, ''), to_html(raw).gsub(%r{\s+}, '') | |||
|
|
205 | end | |||
|
|
206 | ||||
| 200 | private |
|
207 | private | |
| 201 |
|
208 | |||
| 202 | def assert_html_output(to_test, expect_paragraph = true) |
|
209 | def assert_html_output(to_test, expect_paragraph = true) | |
General Comments 0
You need to be logged in to leave comments.
Login now