From 5cbccda33a00009724b9d223c41d22c5dc95eba1 Mon Sep 17 00:00:00 2001 From: Dorian Date: Fri, 24 Dec 2010 15:49:26 +0100 Subject: [PATCH] Spec for not allowing user to do the XSS --- spec/helpers/application_helper_spec.rb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb index 440ccb025..a6633eafa 100644 --- a/spec/helpers/application_helper_spec.rb +++ b/spec/helpers/application_helper_spec.rb @@ -41,6 +41,14 @@ describe ApplicationHelper do person_image_link(@person).should include(person_path(@person)) end end + + describe "#person_image_tag" do + it "should not allow basic XSS/HTML" do + @person.profile.first_name = "I'm

Evil" + @person.profile.last_name = "I'm

Evil" + person_image_tag(@person).should_not include("

") + end + end describe "markdownify" do describe "autolinks" do