| @@ -197,6 +197,13 EXPECTED | |||
|
|
197 | 197 | assert_equal '<p>[msg1][msg2]</p>', to_html('[msg1][msg2]') |
|
|
198 | 198 | end |
|
|
199 | 199 | |
|
|
200 | def test_textile_should_escape_image_urls | |
|
|
201 | # this is onclick="alert('XSS');" in encoded form | |
|
|
202 | raw = '!/images/comment.png"onclick=alert('XSS');"!' | |
|
|
203 | expected = '<p><img src="/images/comment.png"onclick=&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;;&#x22;" alt="" /></p>' | |
|
|
204 | assert_equal expected.gsub(%r{\s+}, ''), to_html(raw).gsub(%r{\s+}, '') | |
|
|
205 | end | |
|
|
206 | ||
|
|
200 | 207 | private |
|
|
201 | 208 | |
|
|
202 | 209 | def assert_html_output(to_test, expect_paragraph = true) |
General Comments 0
You need to be logged in to leave comments.
Login now