SECURITY: sanitize markdown urls (prevent XSS)

2025-06-17 04:42:31 +08:00 · 2014-03-27 15:34:35 +01:00
parent d5b1b64bb8
commit e663d78104
2 changed files with 15 additions and 0 deletions
--- a/test/javascripts/lib/markdown_test.js
+++ b/test/javascripts/lib/markdown_test.js
@ -352,6 +352,8 @@ test("sanitize", function() {
  equal(sanitize("<textarea>hullo</textarea>"), "hullo");
  equal(sanitize("<button>press me!</button>"), "press me!");
  equal(sanitize("<canvas>draw me!</canvas>"), "draw me!");
+
+  cooked("[the answer](javascript:alert(42))", "<p><a>the answer</a></p>", "it prevents XSS");
 });

 test("URLs in BBCode tags", function() {