nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move 'XSS via name parameter' to mobile conversation specs

Browse source 
because the desktop view doesn't use the name parameter anymore
This commit is contained in:
Steffen van Bergerem 2016-11-13 15:22:03 +01:00 committed by Benjamin Neff
parent 2b6465ef25
commit 9cbadec659
1 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
spec/controllers/conversations_controller_spec.rb
View file

@ -17,7 +17,7 @@ describe ConversationsController, :type => :controller do
end
describe "#new modal" do
context "desktop and mobile" do
context "desktop" do
it "succeeds" do
get :new, modal: true
expect(response).to be_success
@ -32,14 +32,6 @@ describe ConversationsController, :type => :controller do
get :new, aspect_id: alice.aspects.first.id, modal: true
expect(controller.gon.conversation_prefill).to eq(alice.aspects.first.contacts.map {|c| c.person.as_json })
end
it "does not allow XSS via the name parameter" do
["</script><script>alert(1);</script>",
'"}]});alert(1);(function f() {var foo = [{b:"'].each do |xss|
get :new, modal: true, name: xss
expect(response.body).not_to include xss
end
end
end
context "mobile" do
@ -58,6 +50,14 @@ describe ConversationsController, :type => :controller do
expect(assigns(:contacts_json)).not_to include(alice.contacts.where(receiving: false).first.person.name)
end
it "does not allow XSS via the name parameter" do
["</script><script>alert(1);</script>",
'"}]});alert(1);(function f() {var foo = [{b:"'].each do |xss|
get :new, modal: true, name: xss
expect(response.body).not_to include xss
end
end
it "does not allow XSS via the profile name" do
xss = "<script>alert(0);</script>"
contact = alice.contacts.first