diff options
Diffstat (limited to 'js/src/util/sanitizer.spec.js')
| -rw-r--r-- | js/src/util/sanitizer.spec.js | 70 |
1 files changed, 0 insertions, 70 deletions
diff --git a/js/src/util/sanitizer.spec.js b/js/src/util/sanitizer.spec.js deleted file mode 100644 index 6dadd29a5..000000000 --- a/js/src/util/sanitizer.spec.js +++ /dev/null @@ -1,70 +0,0 @@ -import { DefaultWhitelist, sanitizeHtml } from './sanitizer' - -describe('Sanitizer', () => { - describe('sanitizeHtml', () => { - it('should return the same on empty string', () => { - const empty = '' - - const result = sanitizeHtml(empty, DefaultWhitelist, null) - - expect(result).toEqual(empty) - }) - - it('should sanitize template by removing tags with XSS', () => { - const template = [ - '<div>', - ' <a href="javascript:alert(7)">Click me</a>', - ' <span>Some content</span>', - '</div>' - ].join('') - - const result = sanitizeHtml(template, DefaultWhitelist, null) - - expect(result.indexOf('script') === -1).toEqual(true) - }) - - it('should allow aria attributes and safe attributes', () => { - const template = [ - '<div aria-pressed="true">', - ' <span class="test">Some content</span>', - '</div>' - ].join('') - - const result = sanitizeHtml(template, DefaultWhitelist, null) - - expect(result.indexOf('aria-pressed') !== -1).toEqual(true) - expect(result.indexOf('class="test"') !== -1).toEqual(true) - }) - - it('should remove not whitelist tags', () => { - const template = [ - '<div>', - ' <script>alert(7)</script>', - '</div>' - ].join('') - - const result = sanitizeHtml(template, DefaultWhitelist, null) - - expect(result.indexOf('<script>') === -1).toEqual(true) - }) - - it('should not use native api to sanitize if a custom function passed', () => { - const template = [ - '<div>', - ' <span>Some content</span>', - '</div>' - ].join('') - - function mySanitize(htmlUnsafe) { - return htmlUnsafe - } - - spyOn(DOMParser.prototype, 'parseFromString') - - const result = sanitizeHtml(template, DefaultWhitelist, mySanitize) - - expect(result).toEqual(template) - expect(DOMParser.prototype.parseFromString).not.toHaveBeenCalled() - }) - }) -}) |
