diff options
| author | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-09 18:15:59 -0300 |
|---|---|---|
| committer | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-09 18:15:59 -0300 |
| commit | 7987e7419a75b5677841c4f215791a73083a154a (patch) | |
| tree | 7164002ad5b52dd5a52114cfd9a4a2f7c5fc7049 /actionpack/test | |
| parent | 0f9a6a7c80a2beeaace875d8a9d89a164811d729 (diff) | |
| parent | 64146cf7babe35fd962576b699fa0deb4cfe0d70 (diff) | |
| download | rails-7987e7419a75b5677841c4f215791a73083a154a.tar.gz rails-7987e7419a75b5677841c4f215791a73083a154a.tar.bz2 rails-7987e7419a75b5677841c4f215791a73083a154a.zip | |
Merge branch '3-2-8' into 3-2-stable
Diffstat (limited to 'actionpack/test')
| -rw-r--r-- | actionpack/test/template/form_tag_helper_test.rb | 6 | ||||
| -rw-r--r-- | actionpack/test/template/sanitize_helper_test.rb | 4 |
2 files changed, 8 insertions, 2 deletions
diff --git a/actionpack/test/template/form_tag_helper_test.rb b/actionpack/test/template/form_tag_helper_test.rb index 68dfceef07..6f0d0c3561 100644 --- a/actionpack/test/template/form_tag_helper_test.rb +++ b/actionpack/test/template/form_tag_helper_test.rb @@ -208,6 +208,12 @@ class FormTagHelperTest < ActionView::TestCase assert_dom_equal expected, actual end + def test_select_tag_escapes_prompt + actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "<script>alert(1337)</script>" + expected = %(<select id="places" name="places"><option value=""><script>alert(1337)</script></option><option>Home</option><option>Work</option><option>Pub</option></select>) + assert_dom_equal expected, actual + end + def test_select_tag_with_prompt_and_include_blank actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "string", :include_blank => true expected = %(<select name="places" id="places"><option value="">string</option><option value=""></option><option>Home</option><option>Work</option><option>Pub</option></select>) diff --git a/actionpack/test/template/sanitize_helper_test.rb b/actionpack/test/template/sanitize_helper_test.rb index 222d4dbf4c..cc93b53ea6 100644 --- a/actionpack/test/template/sanitize_helper_test.rb +++ b/actionpack/test/template/sanitize_helper_test.rb @@ -42,9 +42,9 @@ class SanitizeHelperTest < ActionView::TestCase [nil, '', ' '].each do |blank| stripped = strip_tags(blank) assert_equal blank, stripped - assert stripped.html_safe? unless blank.nil? end - assert strip_tags("<script>").html_safe? + assert_equal "", strip_tags("<script>") + assert_equal "something <img onerror=alert(1337)", ERB::Util.html_escape(strip_tags("something <img onerror=alert(1337)")) end def test_sanitize_is_marked_safe |