7134513b28
From a quick look at the for us available databases this was not actually used in the wild.
12 lines
549 B
JavaScript
12 lines
549 B
JavaScript
describe("Diaspora.Widgets.Search", function() {
|
|
describe("parse", function() {
|
|
it("escapes a persons name", function() {
|
|
$("#jasmine_content").html('<form action="#" id="searchForm"></form>');
|
|
|
|
var search = Diaspora.BaseWidget.instantiate("Search", $("#jasmine_content > #searchForm"));
|
|
var person = {"name": "</script><script>alert('xss');</script"};
|
|
result = search.parse([$.extend({}, person)]);
|
|
expect(result[0].data.name).toNotEqual(person.name);
|
|
});
|
|
});
|
|
});
|