diff options
author | Robert Speicher <robert@gitlab.com> | 2017-05-02 17:52:19 +0300 |
---|---|---|
committer | Bob Van Landuyt <bob@gitlab.com> | 2017-05-10 17:44:20 +0300 |
commit | 99996b6bc7c13e7e7f871919942907b380d4b58c (patch) | |
tree | c87b232ade284781ae96d2819636c639d584972b /spec/lib/gitlab/asciidoc_spec.rb | |
parent | 9b03ed0a182c9ad96957085826cc85f8f229569c (diff) |
Merge branch 'bvl-security-9-1-markup-pipeline'
(security-9-1) Render asciidoc & other markup using banzai in a pipeline
See merge request !2098
Diffstat (limited to 'spec/lib/gitlab/asciidoc_spec.rb')
-rw-r--r-- | spec/lib/gitlab/asciidoc_spec.rb | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/spec/lib/gitlab/asciidoc_spec.rb b/spec/lib/gitlab/asciidoc_spec.rb index 0f47fb2fbd9..f284dd14cec 100644 --- a/spec/lib/gitlab/asciidoc_spec.rb +++ b/spec/lib/gitlab/asciidoc_spec.rb @@ -22,7 +22,7 @@ module Gitlab expect(Asciidoctor).to receive(:convert) .with(input, expected_asciidoc_opts).and_return(html) - expect(render(input)).to eq(html) + expect(render(input, context)).to eq(html) end context "XSS" do @@ -33,7 +33,7 @@ module Gitlab }, 'images' => { input: 'image:https://localhost.com/image.png[Alt text" onerror="alert(7)]', - output: "<div>\n<p><span><img src=\"https://localhost.com/image.png\" alt=\"Alt text\"></span></p>\n</div>" + output: "<img src=\"https://localhost.com/image.png\" alt=\"Alt text\">" }, 'pre' => { input: '```mypre"><script>alert(3)</script>', @@ -43,10 +43,18 @@ module Gitlab links.each do |name, data| it "does not convert dangerous #{name} into HTML" do - expect(render(data[:input])).to eq(data[:output]) + expect(render(data[:input], context)).to include(data[:output]) end end end + + context 'external links' do + it 'adds the `rel` attribute to the link' do + output = render('link:https://google.com[Google]', context) + + expect(output).to include('rel="nofollow noreferrer"') + end + end end def render(*args) |