require 'abstract_unit' # The exhaustive tests are in test/template/html-scanner/sanitizer_test.rb # This tests the that the helpers hook up correctly to the sanitizer classes. class SanitizeHelperTest < ActionView::TestCase tests ActionView::Helpers::SanitizeHelper def test_strip_links_pending skip "Pending. These tests don't pass. See explanation in sanitizers_test.rb" assert_equal "day long", strip_links("<a href='hello'>all day long</a>") end def test_strip_links assert_equal "Dont touch me", strip_links("Dont touch me") assert_equal "on my mind\nall day long", strip_links("on my mind\nall day long") assert_equal "0wn3d", strip_links("0wn3d") assert_equal "Magic", strip_links("Magic") assert_equal "FrrFox", strip_links("FrrFox") assert_equal "My mind\nall day long", strip_links("My mind\nall day long") end def test_sanitize_form assert_equal '', sanitize("
") end def test_should_sanitize_illegal_style_properties raw = %(display:block; position:absolute; left:0; top:0; width:100%; height:100%; z-index:1; background-color:black; background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg); background-x:center; background-y:center; background-repeat:repeat;) expected = %(display: block; width: 100%; height: 100%; background-color: black; background-x: center; background-y: center;) assert_equal expected, sanitize_css(raw) end def test_strip_tags_pending skip "Pending. These tests don't pass. See explanation in sanitizers_test.rb" assert_equal("<<")) assert_equal("Weirdos", strip_tags("Wei<a onclick='alert(document.cookie);'/>rdos")) assert_equal( %{This is a test.\n\n\nIt no longer contains any HTML.\n}, strip_tags( %{This is <b>a <a href="" target="_blank">test</a></b>.\n\n\n\n

It no longer contains any HTML.

\n})) # fails on the blank string [nil, '', ' '].each do |blank| stripped = strip_tags(blank) assert_equal blank, stripped end # Actual: "something " assert_equal "something <img onerror=alert(1337)", ERB::Util.html_escape(strip_tags("something This is a test.

")) assert_equal("This is a test.", strip_tags("This is a test.")) assert_equal "This has a here.", strip_tags("This has a here.") assert_equal "", strip_tags("").html_safe? end end