2022-01-01 13:38:12 +00:00
|
|
|
# Copyright (C) 2012-2022 Zammad Foundation, https://zammad-foundation.org/
|
2021-06-01 12:20:20 +00:00
|
|
|
|
2019-02-12 07:38:59 +00:00
|
|
|
RSpec.shared_examples 'HasXssSanitizedNote' do |model_factory:|
|
|
|
|
|
describe 'XSS prevention' do
|
|
|
|
|
context 'with injected JS' do
|
|
|
|
|
subject { create(model_factory, note: 'test 123 <script type="text/javascript">alert("XSS!");</script> <b>some text</b>') }
|
2019-04-15 01:41:17 +00:00
|
|
|
|
2021-09-29 08:13:40 +00:00
|
|
|
it 'strips out <script> tag with content' do
|
|
|
|
|
expect(subject.note).to eq('test 123 <b>some text</b>')
|
2019-02-12 07:38:59 +00:00
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
end
|
