# encoding: utf-8 require 'test_helper' class HtmlSanitizerTest < ActiveSupport::TestCase test 'xss' do assert_equal(HtmlSanitizer.strict('123'), '123') assert_equal(HtmlSanitizer.strict(''), '<b>123</b>') assert_equal(HtmlSanitizer.strict(''), '<style><b>123</b></style>') assert_equal(HtmlSanitizer.strict('123123'), '123123') assert_equal(HtmlSanitizer.strict('123123abc'), '123123abc') assert_equal(HtmlSanitizer.strict('123'), '123') assert_equal(HtmlSanitizer.strict(''), 'alert("XSS!");') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('">'), 'alert("XSS")">') assert_equal(HtmlSanitizer.strict('

'), '

') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict('<'), '<alert("XSS");//<') assert_equal(HtmlSanitizer.strict(''), 'alert(\'XSS\');') assert_equal(HtmlSanitizer.strict('

XSS
'), '

XSS

') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict('

'), '

') assert_equal(HtmlSanitizer.strict('

'), '

') assert_equal(HtmlSanitizer.strict('test'), 'test') assert_equal(HtmlSanitizer.strict('test'), 'test') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict(' +ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-/SCRIPT+AD4-'), ' +ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-/SCRIPT+AD4-') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict('XSS'), 'XSS') assert_equal(HtmlSanitizer.strict('XSS'), 'XSS') assert_equal(HtmlSanitizer.strict(''), 'X') assert_equal(HtmlSanitizer.strict('CLICKME'), 'CLICKME') assert_equal(HtmlSanitizer.strict('CLICKME'), 'CLICKME') assert_equal(HtmlSanitizer.strict('

'), '

') assert_equal(HtmlSanitizer.strict('

'), '

') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '

') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict('

'), '') assert_equal(HtmlSanitizer.strict(''), '') assert_equal(HtmlSanitizer.strict('XXX'), 'XXX') assert_equal(HtmlSanitizer.strict(''), 'alert(1)') assert_equal(HtmlSanitizer.strict(''), '') end end