github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-14 19:29:21 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Sanitize custom quote attributes

Browse Source
This commit is contained in:
Robin Ward
2014-04-21 09:20:39 -04:00
parent faec113710
commit 4dc20e6855
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
test/javascripts/lib/bbcode_test.js
View File

@ -99,6 +99,9 @@ test("quotes", function() {
"<aside class=\"quote\"><blockquote><p><em>test</em></p></blockquote></aside>",
"it doesn't insert a new line for italics");
format("[quote,script='a'><script>alert('test');//':a][/quote]",
"<aside class=\"quote\" data-script=&#x27;a&#x27;&gt;&lt;script&gt;alert(&#x27;test&#x27;);//&#x27;=\"a\"><blockquote></blockquote></aside>",
"It will not create a script tag within an attribute");
});
test("quote formatting", function() {