Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-07 12:02:53 +08:00
Code Packages Activity Actions 5

SECURITY: fix XSS in link's href

Browse source
This commit is contained in:
Régis Hanol 2014-07-15 16:11:37 +02:00
parent 09924da60b
commit a9342dbf92
2 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
test/javascripts/lib/markdown_test.js
View file

@ -401,14 +401,20 @@ test("URLs in BBCode tags", function() {
});
test("urlAllowed", function() {
var urlAllowed = Discourse.Markdown.urlAllowed;
var allowed = function(url, msg) {
equal(Discourse.Markdown.urlAllowed(url), url, msg);
equal(urlAllowed(url), url, msg);
};
allowed("/foo/bar.html", "allows relative urls");
allowed("http://eviltrout.com/evil/trout", "allows full urls");
allowed("https://eviltrout.com/evil/trout", "allows https urls");
allowed("//eviltrout.com/evil/trout", "allows protocol relative urls");
equal(urlAllowed("http://google.com/test'onmouseover=alert('XSS!');//.swf"),
"http://google.com/test'onmouseover=alert('XSS!');//.swf",
"escape single quotes");
});
test("images", function() {