diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2023-03-30 16:38:24 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2023-03-30 16:38:24 +0300 |
commit | d6192c2ab77ab814b9bd66103663047556fd67e4 (patch) | |
tree | 78253d9abc4a68b07c0013e4d8448f0104cd199d /spec/features/admin/users/user_spec.rb | |
parent | 5e57ed483af358e2404891d87d1f68a8cf60ef89 (diff) |
Add latest changes from gitlab-org/security/gitlab@15-9-stable-eev15.9.4
Diffstat (limited to 'spec/features/admin/users/user_spec.rb')
-rw-r--r-- | spec/features/admin/users/user_spec.rb | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/spec/features/admin/users/user_spec.rb b/spec/features/admin/users/user_spec.rb index 1552d4e6187..66129617220 100644 --- a/spec/features/admin/users/user_spec.rb +++ b/spec/features/admin/users/user_spec.rb @@ -271,6 +271,36 @@ RSpec.describe 'Admin::Users::User', feature_category: :user_management do icon = first('[data-testid="incognito-icon"]') expect(icon).not_to be nil end + + context 'when viewing the confirm email warning', :js do + let_it_be(:another_user) { create(:user, :unconfirmed) } + + let(:warning_alert) { page.find(:css, '[data-testid="alert-warning"]') } + let(:expected_styling) { { 'pointer-events' => 'none', 'cursor' => 'default' } } + + context 'with an email that does not contain HTML' do + before do + subject + end + + it 'displays the warning alert including the email' do + expect(warning_alert.text).to include("Please check your email (#{another_user.email}) to verify") + end + end + + context 'with an email that contains HTML' do + let(:malicious_email) { "malicious@test.com<form><input/title='<script>alert(document.domain)</script>'>" } + let(:another_user) { create(:user, confirmed_at: nil, unconfirmed_email: malicious_email) } + + before do + subject + end + + it 'displays the impersonation alert, excludes email, and disables links' do + expect(warning_alert.text).to include("check your email (#{another_user.unconfirmed_email}) to verify") + end + end + end end context 'ending impersonation' do |