diff options
author | Aaron Patterson <aaron.patterson@gmail.com> | 2013-03-15 15:04:00 -0700 |
---|---|---|
committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-03-15 17:48:42 -0700 |
commit | 99123ad12f71ce3e7fe70656810e53133665527c (patch) | |
tree | b6767d154980bc0a47ca86b3c4d2d1edea2d2c69 /actionpack/test/template/html-scanner | |
parent | c0d06633f0eafd1ef8cf51b4913894d6c8c9b58f (diff) | |
download | rails-99123ad12f71ce3e7fe70656810e53133665527c.tar.gz rails-99123ad12f71ce3e7fe70656810e53133665527c.tar.bz2 rails-99123ad12f71ce3e7fe70656810e53133665527c.zip |
fix protocol checking in sanitization [CVE-2013-1857]
Conflicts:
actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
Diffstat (limited to 'actionpack/test/template/html-scanner')
-rw-r--r-- | actionpack/test/template/html-scanner/sanitizer_test.rb | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/actionpack/test/template/html-scanner/sanitizer_test.rb b/actionpack/test/template/html-scanner/sanitizer_test.rb index 4e2ad4e955..dee60c9d00 100644 --- a/actionpack/test/template/html-scanner/sanitizer_test.rb +++ b/actionpack/test/template/html-scanner/sanitizer_test.rb @@ -176,6 +176,7 @@ class SanitizerTest < ActionController::TestCase %(<IMG SRC="jav
ascript:alert('XSS');">), %(<IMG SRC="jav
ascript:alert('XSS');">), %(<IMG SRC="  javascript:alert('XSS');">), + %(<IMG SRC="javascript:alert('XSS');">), %(<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>)].each_with_index do |img_hack, i| define_method "test_should_not_fall_for_xss_image_hack_#{i+1}" do assert_sanitized img_hack, "<img>" @@ -281,6 +282,15 @@ class SanitizerTest < ActionController::TestCase assert_sanitized "<span class=\"\\", "<span class=\"\\\">" end + def test_x03a + assert_sanitized %(<a href="javascript:alert('XSS');">), "<a>" + assert_sanitized %(<a href="javascript:alert('XSS');">), "<a>" + assert_sanitized %(<a href="http://legit">), %(<a href="http://legit">) + assert_sanitized %(<a href="javascript:alert('XSS');">), "<a>" + assert_sanitized %(<a href="javascript:alert('XSS');">), "<a>" + assert_sanitized %(<a href="http://legit">), %(<a href="http://legit">) + end + protected def assert_sanitized(input, expected = nil) @sanitizer ||= HTML::WhiteListSanitizer.new |