From 5cbccda33a00009724b9d223c41d22c5dc95eba1 Mon Sep 17 00:00:00 2001
From: Dorian <pr.dorian@gmail.com>
Date: Fri, 24 Dec 2010 15:49:26 +0100
Subject: [PATCH] Spec for not allowing user to do the XSS
---
spec/helpers/application_helper_spec.rb | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 440ccb0251..a6633eafa6 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -41,6 +41,14 @@ describe ApplicationHelper do
person_image_link(@person).should include(person_path(@person))
end
end
+
+ describe "#person_image_tag" do
+ it "should not allow basic XSS/HTML" do
+ @person.profile.first_name = "I'm <h1>Evil"
+ @person.profile.last_name = "I'm <h1>Evil"
+ person_image_tag(@person).should_not include("<h1>")
+ end
+ end
describe "markdownify" do
describe "autolinks" do
--
GitLab