diff options
author | Douwe Maan <douwe@selenight.nl> | 2018-06-15 15:05:26 +0300 |
---|---|---|
committer | Douwe Maan <douwe@selenight.nl> | 2018-06-18 11:54:04 +0300 |
commit | e1a77fa757c65cf243e6b74bf83a394da923ef0f (patch) | |
tree | 04bc841528fbde88b083e350acffa67cd5aa5cae /spec/lib/banzai | |
parent | bc2cf82f68d64622e3ca2facb601c711bf1682e6 (diff) |
Whitelist text-align property for th and td
Diffstat (limited to 'spec/lib/banzai')
-rw-r--r-- | spec/lib/banzai/filter/sanitization_filter_spec.rb | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/spec/lib/banzai/filter/sanitization_filter_spec.rb b/spec/lib/banzai/filter/sanitization_filter_spec.rb index 17a620ef603..d930c608b18 100644 --- a/spec/lib/banzai/filter/sanitization_filter_spec.rb +++ b/spec/lib/banzai/filter/sanitization_filter_spec.rb @@ -93,6 +93,16 @@ describe Banzai::Filter::SanitizationFilter do expect(doc.at_css('td')['style']).to eq 'text-align: center' end + it 'disallows `text-align` property in `style` attribute on other elements' do + html = <<~HTML + <div style="text-align: center">Text</div> + HTML + + doc = filter(html) + + expect(doc.at_css('div')['style']).to be_nil + end + it 'allows `span` elements' do exp = act = %q{<span>Hello</span>} expect(filter(act).to_html).to eq exp @@ -224,7 +234,7 @@ describe Banzai::Filter::SanitizationFilter do 'protocol-based JS injection: spaces and entities' => { input: '<a href="  javascript:alert(\'XSS\');">foo</a>', - output: '<a href="">foo</a>' + output: '<a href>foo</a>' }, 'protocol whitespace' => { |