diff options
| author | Louise Crow <louise.crow@gmail.com> | 2014-12-22 10:56:00 +0000 |
|---|---|---|
| committer | Louise Crow <louise.crow@gmail.com> | 2014-12-22 16:33:13 +0000 |
| commit | cd68dbe8ef1339b930aa494a4fdae6cd2d6a50e7 (patch) | |
| tree | 30de6e5ef57f1f09e2a418af87bf96e53b6f60ec | |
| parent | 55f7ac2004f53ebc48efb90c45f64563a7cd660d (diff) | |
Sanitize the blog contents0.18.0.17hotfix/0.18.0.17
| -rw-r--r-- | app/views/general/blog.html.erb | 4 | ||||
| -rw-r--r-- | spec/controllers/general_controller_spec.rb | 12 | ||||
| -rw-r--r-- | spec/fixtures/files/blog_feed.atom | 2 |
3 files changed, 15 insertions, 3 deletions
diff --git a/app/views/general/blog.html.erb b/app/views/general/blog.html.erb index 5dda7ab74..fd87bd9fe 100644 --- a/app/views/general/blog.html.erb +++ b/app/views/general/blog.html.erb @@ -10,9 +10,9 @@ <p class="subtitle"><%= _("Posted on {{date}} by {{author}}", :date=>simple_date(Time.parse(item['pubDate'][0])), :author=> item['creator'] ? item['creator'][0] : item['author'][0]) %></p> <div> <% if item['encoded'] %> - <%= raw item['encoded'][0] %> + <%= sanitize(raw item['encoded'][0]) %> <% elsif item['description'] %> - <%= raw item['description'][0] %> + <%= sanitize(raw item['description'][0]) %> <% end %> </div> <p><em> diff --git a/spec/controllers/general_controller_spec.rb b/spec/controllers/general_controller_spec.rb index 7590a5b42..df8554f0c 100644 --- a/spec/controllers/general_controller_spec.rb +++ b/spec/controllers/general_controller_spec.rb @@ -53,6 +53,18 @@ describe GeneralController, 'when getting the blog feed' do end end + context 'when the blog has entries' do + + render_views + + it 'should escape any javascript from the entries' do + controller.stub!(:quietly_try_to_open).and_return(load_file_fixture("blog_feed.atom")) + get :blog + response.body.should_not include('<script>alert("exciting!")</script>') + end + + end + end describe GeneralController, "when showing the frontpage" do diff --git a/spec/fixtures/files/blog_feed.atom b/spec/fixtures/files/blog_feed.atom index f49693938..a831243b4 100644 --- a/spec/fixtures/files/blog_feed.atom +++ b/spec/fixtures/files/blog_feed.atom @@ -29,7 +29,7 @@ <guid isPermaLink="false">http://www.example.com/?id=333</guid> <description><![CDATA[An example post [...]]]></description> <content:encoded><![CDATA[<h3>A blog post</h3> -<p>Example post</p> +<p>Example post</p><script>alert("exciting!")</script> ]]></content:encoded> <wfw:commentRss>http://www.example.com/feed/</wfw:commentRss> <slash:comments>2</slash:comments> |