github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-06 11:14:42 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Change the approach to sanitization. Includes a more detailed API

Browse Source 
for allowing classes and attributes for only certain tag names.
This commit is contained in:
Robin Ward
2014-07-03 16:54:56 -04:00
parent cfeae239a8
commit fc1ce96dbb
10 changed files with 128 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
test/javascripts/lib/markdown_test.js
View File

@ -6,6 +6,8 @@ module("Discourse.Markdown", {
var cooked = function(input, expected, text) {
var result = Discourse.Markdown.cook(input, {sanitize: true});
expected = expected.replace(/\/>/g, ">");
// result = result.replace("/>", ">");
equal(result, expected, text);
};
@ -138,6 +140,8 @@ test("Links", function() {
cooked("User [MOD]: Hello!",
"<p>User [MOD]: Hello!</p>",
"It does not consider references that are obviously not URLs");
cooked("<small>http://eviltrout.com</small>", "<p><small><a href=\"http://eviltrout.com\">http://eviltrout.com</a></small></p>", "Links within HTML tags");
});
test("simple quotes", function() {
@ -240,6 +244,9 @@ test("Mentions", function() {
"<p><a class=\"mention\" href=\"/users/eviltrout\">@eviltrout</a></p>",
"it doesn't onebox mentions");
cookedOptions("<small>a @sam c</small>", alwaysTrue,
"<p><small>a <a class=\"mention\" href=\"/users/sam\">@sam</a> c</small></p>",
"it allows mentions within HTML tags");
});
@ -370,7 +377,7 @@ test("sanitize", function() {
cooked("[the answer](javascript:alert(42))", "<p><a>the answer</a></p>", "it prevents XSS");
cooked("<i class=\"fa fa-bug fa-spin\" style=\"font-size:600%\"></i>\n<!-- -->", "<p><i></i><br/>&lt;!-- --&gt;</p>", "it doesn't circumvent XSS with comments");
cooked("<i class=\"fa fa-bug fa-spin\" style=\"font-size:600%\"></i>\n<!-- -->", "<p><i></i><br/></p>", "it doesn't circumvent XSS with comments");
});
test("URLs in BBCode tags", function() {