diff options
Diffstat (limited to 'spec')
-rw-r--r-- | spec/features/projects/blobs/blob_show_spec.rb | 2 | ||||
-rw-r--r-- | spec/frontend/blob/openapi/index_spec.js | 2 | ||||
-rw-r--r-- | spec/initializers/rails_yaml_safe_load_spec.rb | 43 |
3 files changed, 45 insertions, 2 deletions
diff --git a/spec/features/projects/blobs/blob_show_spec.rb b/spec/features/projects/blobs/blob_show_spec.rb index d679d1eeeb9..e01382cf31f 100644 --- a/spec/features/projects/blobs/blob_show_spec.rb +++ b/spec/features/projects/blobs/blob_show_spec.rb @@ -1002,7 +1002,7 @@ RSpec.describe 'File blob', :js do end it 'renders sandboxed iframe' do - expected = %(<iframe src="/-/sandbox/swagger" sandbox="allow-scripts" frameborder="0" width="100%" height="1000">) + expected = %(<iframe src="/-/sandbox/swagger" sandbox="allow-scripts allow-popups" frameborder="0" width="100%" height="1000">) expect(page.html).to include(expected) end end diff --git a/spec/frontend/blob/openapi/index_spec.js b/spec/frontend/blob/openapi/index_spec.js index 5884b27d951..17e718df495 100644 --- a/spec/frontend/blob/openapi/index_spec.js +++ b/spec/frontend/blob/openapi/index_spec.js @@ -21,7 +21,7 @@ describe('OpenAPI blob viewer', () => { it('initializes SwaggerUI with the correct configuration', () => { expect(document.body.innerHTML).toContain( - '<iframe src="/-/sandbox/swagger" sandbox="allow-scripts" frameborder="0" width="100%" height="1000"></iframe>', + '<iframe src="/-/sandbox/swagger" sandbox="allow-scripts allow-popups" frameborder="0" width="100%" height="1000"></iframe>', ); }); }); diff --git a/spec/initializers/rails_yaml_safe_load_spec.rb b/spec/initializers/rails_yaml_safe_load_spec.rb new file mode 100644 index 00000000000..8cf6a3676e0 --- /dev/null +++ b/spec/initializers/rails_yaml_safe_load_spec.rb @@ -0,0 +1,43 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Rails YAML safe load' do + let(:unsafe_load) { false } + + let(:klass) do + Class.new(ActiveRecord::Base) do + self.table_name = 'issues' + + serialize :description + end + end + + let(:instance) { klass.new(description: data) } + + context 'with default permitted classes' do + let(:data) do + { + 'time' => Time.now, + 'date' => Date.today, + 'number' => 1, + 'hashie-array' => Hashie::Array.new([1, 2]), + 'array' => [5, 6] + } + end + + it 'deserializes data' do + instance.save! + + expect(klass.find(instance.id).description).to eq(data) + end + + context 'with unpermitted classes' do + let(:data) { { 'test' => create(:user) } } + + it 'throws an exception' do + expect { instance.save! }.to raise_error(Psych::DisallowedClass) + end + end + end +end |