diff options
author | Gabriel Mazetto <gabriel@gitlab.com> | 2016-06-02 06:52:35 +0300 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2016-06-13 04:05:58 +0300 |
commit | 13791c6704ea6fbca7bcdb2da8e042b00849d783 (patch) | |
tree | ece9cfd8de6eec5b42f7498d8d67f1e7d4e63acf /spec/lib | |
parent | 02b882418a44bccbcde403886c560505abd60281 (diff) |
Refactor SVG sanitizer and prevent `xlink:href` to refer to external resources
Diffstat (limited to 'spec/lib')
-rw-r--r-- | spec/lib/gitlab/sanitizers/svg_spec.rb | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/spec/lib/gitlab/sanitizers/svg_spec.rb b/spec/lib/gitlab/sanitizers/svg_spec.rb index bb1c98f51a6..061b759bac0 100644 --- a/spec/lib/gitlab/sanitizers/svg_spec.rb +++ b/spec/lib/gitlab/sanitizers/svg_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' describe Gitlab::Sanitizers::SVG do let(:scrubber) { Gitlab::Sanitizers::SVG::Scrubber.new } - let(:namespace) { double(Nokogiri::XML::Namespace, prefix: 'xlink') } - let(:namespaced_attr) { double(Nokogiri::XML::Attr, name: 'href', namespace: namespace) } + let(:namespace) { double(Nokogiri::XML::Namespace, prefix: 'xlink', href: 'http://www.w3.org/1999/xlink') } + let(:namespaced_attr) { double(Nokogiri::XML::Attr, name: 'href', namespace: namespace, value: '#awesome_id') } context 'scrubber' do describe '#scrub' do - let(:invalid_element) { double(Nokogiri::XML::Node, name: 'invalid') } + let(:invalid_element) { double(Nokogiri::XML::Node, name: 'invalid', value: 'invalid') } let(:invalid_attribute) { double(Nokogiri::XML::Attr, name: 'invalid', namespace: nil) } let(:valid_element) { double(Nokogiri::XML::Node, name: 'use') } @@ -44,5 +44,17 @@ describe Gitlab::Sanitizers::SVG do expect(scrubber.attribute_name_with_namespace(namespaced_attr)).to eq('xlink:href') end end + + describe '#unsafe_href?' do + let(:unsafe_attr) { double(Nokogiri::XML::Attr, name: 'href', namespace: namespace, value: 'http://evilsite.example.com/random.svg') } + + it 'returns true if href attribute is an external url' do + expect(scrubber.unsafe_href?(unsafe_attr)).to be_truthy + end + + it 'returns false if href atttribute is an internal reference' do + expect(scrubber.unsafe_href?(namespaced_attr)).to be_falsey + end + end end end |