diff options
author | Douwe Maan <douwe@gitlab.com> | 2017-08-30 20:34:34 +0300 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2017-09-08 03:22:16 +0300 |
commit | 9b09856e7b853146ac4ff03d388f7063e6f0efbd (patch) | |
tree | 07917aaf32abdeed859fe5357ab0912e696f914e /spec/lib/banzai | |
parent | 8629d5822a1a7af5708ebb785982b25e0d2400bf (diff) |
Merge branch 'rs-issue-36104' into 'security-9-5'
[9.5] Disallow the `name` attribute on all user-provided markup
See merge request gitlab/gitlabhq!2166
Diffstat (limited to 'spec/lib/banzai')
-rw-r--r-- | spec/lib/banzai/filter/sanitization_filter_spec.rb | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/spec/lib/banzai/filter/sanitization_filter_spec.rb b/spec/lib/banzai/filter/sanitization_filter_spec.rb index 659b4460fc3..01ceb21dfaa 100644 --- a/spec/lib/banzai/filter/sanitization_filter_spec.rb +++ b/spec/lib/banzai/filter/sanitization_filter_spec.rb @@ -101,6 +101,18 @@ describe Banzai::Filter::SanitizationFilter do expect(filter(act).to_html).to eq exp end + it 'disallows the `name` attribute globally' do + html = <<~HTML + <img name="getElementById" src=""> + <span name="foo" class="bar">Hi</span> + HTML + + doc = filter(html) + + expect(doc.at_css('img')).not_to have_attribute('name') + expect(doc.at_css('span')).not_to have_attribute('name') + end + it 'allows `summary` elements' do exp = act = '<summary>summary line</summary>' expect(filter(act).to_html).to eq exp |