From 983a87175e6f83da1828630cbaad4b33b04c6d81 Mon Sep 17 00:00:00 2001
From: rinpatch <rinpatch@sdf.org>
Date: Thu, 30 Jan 2020 19:47:57 +0300
Subject: mastodon API: do not sanitize html in non-html fields

---
 .../controllers/account_controller/update_credentials_test.exs        | 4 ++--
 test/web/mastodon_api/views/account_view_test.exs                     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'test')

diff --git a/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs b/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs
index 09bdc46e0..82d9e7d2f 100644
--- a/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs
+++ b/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs
@@ -269,7 +269,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController.UpdateCredentialsTest do
         |> json_response(200)
 
       assert account_data["fields"] == [
-               %{"name" => "foo", "value" => "bar"},
+               %{"name" => "<a href=\"http://google.com\">foo</a>", "value" => "bar"},
                %{"name" => "link", "value" => ~S(<a href="http://cofe.io" rel="ugc">cofe.io</a>)}
              ]
 
@@ -297,7 +297,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController.UpdateCredentialsTest do
         |> json_response(200)
 
       assert account["fields"] == [
-               %{"name" => "foo", "value" => "bar"},
+               %{"name" => "<a href=\"http://google.com\">foo</a>", "value" => "bar"},
                %{"name" => "link", "value" => ~S(<a href="http://cofe.io" rel="ugc">cofe.io</a>)}
              ]
 
diff --git a/test/web/mastodon_api/views/account_view_test.exs b/test/web/mastodon_api/views/account_view_test.exs
index 2107bb85c..00c294845 100644
--- a/test/web/mastodon_api/views/account_view_test.exs
+++ b/test/web/mastodon_api/views/account_view_test.exs
@@ -368,10 +368,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountViewTest do
     assert result.pleroma[:settings_store] == nil
   end
 
-  test "sanitizes display names" do
+  test "doesn't sanitize display names" do
     user = insert(:user, name: "<marquee> username </marquee>")
     result = AccountView.render("show.json", %{user: user})
-    refute result.display_name == "<marquee> username </marquee>"
+    assert result.display_name == "<marquee> username </marquee>"
   end
 
   test "never display nil user follow counts" do
-- 
cgit v1.2.3