github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-30 15:28:37 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: XSS in markdown converter.

Browse Source
This commit is contained in:
Robin Ward
2014-04-28 14:43:49 -04:00
parent 495f78f574
commit ba683bc611
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
test/javascripts/lib/markdown_test.js
View File

@ -354,6 +354,8 @@ test("sanitize", function() {
equal(sanitize("<canvas>draw me!</canvas>"), "draw me!");
cooked("[the answer](javascript:alert(42))", "<p><a>the answer</a></p>", "it prevents XSS");
cooked("<i class=\"fa fa-bug fa-spin\" style=\"font-size:600%\"></i>\n<!-- -->", "<p><i></i><br/>&lt;!-- --&gt;</p>", "it doesn't circumvent XSS with comments");
});
test("URLs in BBCode tags", function() {