From 45780be2a7d6ddb5851e04279728c817c941c31c Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@loudthinking.com>
Date: Mon, 9 May 2005 11:24:18 +0000
Subject: Added TextHelper#sanitize that can will remove any Javascript
 handlers, blocks, and forms from an input of HTML.  This allows for use of
 HTML on public sites, but still be free of XSS issues. #1277 [Jamis Buck]

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@1298 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
---
 actionpack/test/template/text_helper_test.rb | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

(limited to 'actionpack/test/template')

diff --git a/actionpack/test/template/text_helper_test.rb b/actionpack/test/template/text_helper_test.rb
index ed2f08e755..926ebdaf47 100644
--- a/actionpack/test/template/text_helper_test.rb
+++ b/actionpack/test/template/text_helper_test.rb
@@ -86,5 +86,29 @@ class TextHelperTest < Test::Unit::TestCase
     assert_equal %(<p>Link #{link2_result}</p>), auto_link("<p>Link #{link2_raw}</p>")
     assert_equal %(<p>#{link2_result} Link</p>), auto_link("<p>#{link2_raw} Link</p>")
   end
+
+  def test_sanitize_form
+    raw = "<form action=\"/foo/bar\" method=\"post\"><input></form>"
+    result = sanitize(raw)
+    assert_equal "&lt;form action='/foo/bar' method='post'><input>&lt;/form>", result
+  end
+
+  def test_sanitize_script
+    raw = "<script language=\"Javascript\">blah blah blah</script>"
+    result = sanitize(raw)
+    assert_equal "&lt;script language='Javascript'>blah blah blah&lt;/script>", result
+  end
+
+  def test_sanitize_js_handlers
+    raw = %{onthis="do that" <a href="#" onclick="hello" name="foo" onbogus="remove me">hello</a>}
+    result = sanitize(raw)
+    assert_equal %{onthis="do that" <a name='foo' href='#'>hello</a>}, result
+  end
+
+  def test_sanitize_javascript_href
+    raw = %{href="javascript:bang" <a href="javascript:bang" name="hello">foo</a>, <span href="javascript:bang">bar</span>}
+    result = sanitize(raw)
+    assert_equal %{href="javascript:bang" <a name='hello'>foo</a>, <span>bar</span>}, result
+  end
   
 end
-- 
cgit v1.2.3