diff options
author | Rémy Coutable <remy@rymai.me> | 2016-10-06 09:33:11 +0300 |
---|---|---|
committer | Rémy Coutable <remy@rymai.me> | 2016-10-06 09:33:11 +0300 |
commit | d51bb99a7e7c4dce4abefbf4967aa69054066c3b (patch) | |
tree | a6aba13ef5161890bbebd0b48bfc36ad3d8f8223 /spec/views | |
parent | 7e493b11546f15f7871a249474edf6afd418af89 (diff) | |
parent | 3f57ea0c0ba55f2612997acfb531f83a70b73323 (diff) |
Merge commit 'dev/security' into 'master'
Signed-off-by: Rémy Coutable <remy@rymai.me>
Diffstat (limited to 'spec/views')
-rw-r--r-- | spec/views/ci/lints/show.html.haml_spec.rb | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/spec/views/ci/lints/show.html.haml_spec.rb b/spec/views/ci/lints/show.html.haml_spec.rb index 793b747e7eb..2dac5ee23c8 100644 --- a/spec/views/ci/lints/show.html.haml_spec.rb +++ b/spec/views/ci/lints/show.html.haml_spec.rb @@ -1,6 +1,52 @@ require 'spec_helper' describe 'ci/lints/show' do + include Devise::TestHelpers + + describe 'XSS protection' do + let(:config_processor) { Ci::GitlabCiYamlProcessor.new(YAML.dump(content)) } + before do + assign(:status, true) + assign(:builds, config_processor.builds) + assign(:stages, config_processor.stages) + assign(:jobs, config_processor.jobs) + end + + context 'when builds attrbiutes contain HTML nodes' do + let(:content) do + { + rspec: { + script: '<h1>rspec</h1>', + stage: 'test' + } + } + end + + it 'does not render HTML elements' do + render + + expect(rendered).not_to have_css('h1', text: 'rspec') + end + end + + context 'when builds attributes do not contain HTML nodes' do + let(:content) do + { + rspec: { + script: 'rspec', + stage: 'test' + } + } + end + + it 'shows configuration in the table' do + render + + expect(rendered).to have_css('td pre', text: 'rspec') + end + end + end + let(:content) do { build_template: { |