Sanitize the blog contents0.18.0.17hotfix/0.18.0.17

2 files changed, 13 insertions, 1 deletions

diff --git a/spec/controllers/general_controller_spec.rb b/spec/controllers/general_controller_spec.rb
index 7590a5b42..df8554f0c 100644
--- a/spec/controllers/general_controller_spec.rb
+++ b/spec/controllers/general_controller_spec.rb
@@ -53,6 +53,18 @@ describe GeneralController, 'when getting the blog feed' do
         end
     end
 
+    context 'when the blog has entries' do
+
+        render_views
+
+        it 'should escape any javascript from the entries' do
+            controller.stub!(:quietly_try_to_open).and_return(load_file_fixture("blog_feed.atom"))
+            get :blog
+            response.body.should_not include('<script>alert("exciting!")</script>')
+        end
+
+    end
+
 end
 
 describe GeneralController, "when showing the frontpage" do
diff --git a/spec/fixtures/files/blog_feed.atom b/spec/fixtures/files/blog_feed.atom
index f49693938..a831243b4 100644
--- a/spec/fixtures/files/blog_feed.atom
+++ b/spec/fixtures/files/blog_feed.atom
@@ -29,7 +29,7 @@
         <guid isPermaLink="false">http://www.example.com/?id=333</guid>
         <description><![CDATA[An example post [...]]]></description>
             <content:encoded><![CDATA[<h3>A blog post</h3>
-<p>Example post</p>
+<p>Example post</p><script>alert("exciting!")</script>
 ]]></content:encoded>
             <wfw:commentRss>http://www.example.com/feed/</wfw:commentRss>
         <slash:comments>2</slash:comments>