Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-07 12:02:53 +08:00
Code Packages Activity Actions 5

SECURITY: sanitize markdown urls (prevent XSS)

Browse source
This commit is contained in:
Régis Hanol 2014-03-27 15:34:35 +01:00
parent d5b1b64bb8
commit e663d78104
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
test/javascripts/lib/markdown_test.js
View file

@ -352,6 +352,8 @@ test("sanitize", function() {
equal(sanitize("<textarea>hullo</textarea>"), "hullo");
equal(sanitize("<button>press me!</button>"), "press me!");
equal(sanitize("<canvas>draw me!</canvas>"), "draw me!");
cooked("[the answer](javascript:alert(42))", "<p><a>the answer</a></p>", "it prevents XSS");
});
test("URLs in BBCode tags", function() {