# encoding: utf-8 require_relative 'common' # Miscellaneous attempts to sneak maliciously crafted HTML past Sanitize. Many # of these are courtesy of (or inspired by) the OWASP XSS Filter Evasion Cheat # Sheet. # # https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet describe 'Malicious HTML' do make_my_diffs_pretty! parallelize_me! before do @s = Sanitize.new(Sanitize::Config::RELAXED) end describe 'comments' do it 'should not allow script injection via conditional comments' do @s.fragment(%[]). must_equal '' end end describe 'interpolation (ERB, PHP, etc.)' do it 'should escape ERB-style tags' do @s.fragment('<% naughty_ruby_code %>'). must_equal '<% naughty_ruby_code %>' @s.fragment('<%= naughty_ruby_code %>'). must_equal '<%= naughty_ruby_code %>' end it 'should remove PHP-style tags' do @s.fragment(''). must_equal '' @s.fragment(''). must_equal '' end end describe '' do it 'should not be possible to inject JS via a malformed event attribute' do @s.document(''). must_equal "\n" end end describe '