diff options
author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-03-25 20:21:03 +0300 |
---|---|---|
committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-03-25 20:21:03 +0300 |
commit | 6199da0cb49d2e30071d2bbb08735ce2265c7aff (patch) | |
tree | 969212c0b02d2bae327501b1c7098014b9ded03a /spec | |
parent | eda120dc4d8599e293afec7789847fd22ca0c1b0 (diff) | |
parent | 057c8c344b6518cb50b81607e0f88734fc164a9e (diff) |
Merge pull request #8007 from mr-vinn/markdown-tags
Allow HTML tags in user Markdown input
Diffstat (limited to 'spec')
-rw-r--r-- | spec/helpers/gitlab_markdown_helper_spec.rb | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/spec/helpers/gitlab_markdown_helper_spec.rb b/spec/helpers/gitlab_markdown_helper_spec.rb index ddbb4467f10..c631acc591d 100644 --- a/spec/helpers/gitlab_markdown_helper_spec.rb +++ b/spec/helpers/gitlab_markdown_helper_spec.rb @@ -727,6 +727,36 @@ describe GitlabMarkdownHelper do expected = "" expect(markdown(actual)).to match(expected) end + + it 'should allow whitelisted HTML tags from the user' do + actual = '<dl><dt>Term</dt><dd>Definition</dd></dl>' + expect(markdown(actual)).to match(actual) + end + + it 'should sanitize tags that are not whitelisted' do + actual = '<textarea>no inputs allowed</textarea> <blink>no blinks</blink>' + expected = 'no inputs allowed no blinks' + expect(markdown(actual)).to match(expected) + expect(markdown(actual)).not_to match('<.textarea>') + expect(markdown(actual)).not_to match('<.blink>') + end + + it 'should allow whitelisted tag attributes from the user' do + actual = '<a class="custom">link text</a>' + expect(markdown(actual)).to match(actual) + end + + it 'should sanitize tag attributes that are not whitelisted' do + actual = '<a href="http://example.com/bar.html" foo="bar">link text</a>' + expected = '<a href="http://example.com/bar.html">link text</a>' + expect(markdown(actual)).to match(expected) + end + + it 'should sanitize javascript in attributes' do + actual = %q(<a href="javascript:alert('foo')">link text</a>) + expected = '<a>link text</a>' + expect(markdown(actual)).to match(expected) + end end describe 'markdown for empty repository' do |