diff --git a/spec/controllers/conversations_controller_spec.rb b/spec/controllers/conversations_controller_spec.rb
index 86709b263..1c824128b 100644
--- a/spec/controllers/conversations_controller_spec.rb
+++ b/spec/controllers/conversations_controller_spec.rb
@@ -17,7 +17,7 @@ describe ConversationsController, :type => :controller do
end
describe "#new modal" do
- context "desktop and mobile" do
+ context "desktop" do
it "succeeds" do
get :new, modal: true
expect(response).to be_success
@@ -32,14 +32,6 @@ describe ConversationsController, :type => :controller do
get :new, aspect_id: alice.aspects.first.id, modal: true
expect(controller.gon.conversation_prefill).to eq(alice.aspects.first.contacts.map {|c| c.person.as_json })
end
-
- it "does not allow XSS via the name parameter" do
- ["",
- '"}]});alert(1);(function f() {var foo = [{b:"'].each do |xss|
- get :new, modal: true, name: xss
- expect(response.body).not_to include xss
- end
- end
end
context "mobile" do
@@ -58,6 +50,14 @@ describe ConversationsController, :type => :controller do
expect(assigns(:contacts_json)).not_to include(alice.contacts.where(receiving: false).first.person.name)
end
+ it "does not allow XSS via the name parameter" do
+ ["",
+ '"}]});alert(1);(function f() {var foo = [{b:"'].each do |xss|
+ get :new, modal: true, name: xss
+ expect(response.body).not_to include xss
+ end
+ end
+
it "does not allow XSS via the profile name" do
xss = ""
contact = alice.contacts.first