diff options
author | Jan Provaznik <jprovaznik@gitlab.com> | 2019-08-16 11:22:57 +0300 |
---|---|---|
committer | Jan Provaznik <jprovaznik@gitlab.com> | 2019-08-23 11:36:51 +0300 |
commit | a98b89e9bcb56b9adc3a4b0bef3e9844bf93bfd0 (patch) | |
tree | 4b7d1487d1bddddd94ae11ede65c14eb63926834 /spec/support/shared_examples/lib | |
parent | 842b4d4ab59f19f7311b7f39948e699a6924fd52 (diff) |
Re-escape whole HTML content instead of only match
When we un-escape HTML text to find references in it, we should then
re-escape the whole text again, not only found matches.
Because we replace matches with milestone/label links (which contain
HTML tags we don't want to escape again), we re-escape HTML text
with placeholders instead of these links and then replace placeholders
in the escaped text.
Diffstat (limited to 'spec/support/shared_examples/lib')
-rw-r--r-- | spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb b/spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb new file mode 100644 index 00000000000..b1ecd4fd007 --- /dev/null +++ b/spec/support/shared_examples/lib/banzai/filters/reference_filter_shared_examples.rb @@ -0,0 +1,23 @@ +# frozen_string_literal: true + +RSpec.shared_examples 'HTML text with references' do + let(:markdown_prepend) { "<img src=\"\" onerror=alert(`bug`)>" } + + it 'preserves escaped HTML text and adds valid references' do + reference = resource.to_reference(format: :name) + + doc = reference_filter("#{markdown_prepend}#{reference}") + + expect(doc.to_html).to start_with(markdown_prepend) + expect(doc.text).to eq %(<img src="" onerror=alert(`bug`)>#{resource_text}) + end + + it 'preserves escaped HTML text if there are no valid references' do + reference = "#{resource.class.reference_prefix}invalid" + text = "#{markdown_prepend}#{reference}" + + doc = reference_filter(text) + + expect(doc.to_html).to eq text + end +end |