diff options
Diffstat (limited to 'actionview/test')
-rw-r--r-- | actionview/test/template/sanitizers_test.rb | 33 |
1 files changed, 0 insertions, 33 deletions
diff --git a/actionview/test/template/sanitizers_test.rb b/actionview/test/template/sanitizers_test.rb index dc2fcf61e8..3a2d95fc87 100644 --- a/actionview/test/template/sanitizers_test.rb +++ b/actionview/test/template/sanitizers_test.rb @@ -149,39 +149,6 @@ class SanitizerTest < ActionController::TestCase end end - def test_should_flag_bad_protocols - sanitizer = ActionView::WhiteListSanitizer.new - %w(about chrome data disk hcp help javascript livescript lynxcgi lynxexec ms-help ms-its mhtml mocha opera res resource shell vbscript view-source vnd.ms.radio wysiwyg).each do |proto| - assert sanitizer.send(:contains_bad_protocols?, 'src', "#{proto}://bad") - end - end - - def test_should_accept_good_protocols_ignoring_case - sanitizer = ActionView::WhiteListSanitizer.new - ActionView::WhiteListSanitizer.allowed_protocols.each do |proto| - assert !sanitizer.send(:contains_bad_protocols?, 'src', "#{proto.capitalize}://good") - end - end - - def test_should_accept_good_protocols_ignoring_space - sanitizer = ActionView::WhiteListSanitizer.new - ActionView::WhiteListSanitizer.allowed_protocols.each do |proto| - assert !sanitizer.send(:contains_bad_protocols?, 'src', " #{proto}://good") - end - end - - def test_should_accept_good_protocols - sanitizer = ActionView::WhiteListSanitizer.new - ActionView::WhiteListSanitizer.allowed_protocols.each do |proto| - assert !sanitizer.send(:contains_bad_protocols?, 'src', "#{proto}://good") - end - end - - def test_should_reject_hex_codes_in_protocol - assert_sanitized %(<a href="%6A%61%76%61%73%63%72%69%70%74%3A%61%6C%65%72%74%28%22%58%53%53%22%29">1</a>), "<a>1</a>" - assert @sanitizer.send(:contains_bad_protocols?, 'src', "%6A%61%76%61%73%63%72%69%70%74%3A%61%6C%65%72%74%28%22%58%53%53%22%29") - end - def test_should_block_script_tag assert_sanitized %(<SCRIPT\nSRC=http://ha.ckers.org/xss.js></SCRIPT>), "" end |