diff options
Diffstat (limited to 'spec/controllers')
| -rw-r--r-- | spec/controllers/general_controller_spec.rb | 12 | ||||
| -rw-r--r-- | spec/controllers/request_controller_spec.rb | 12 |
2 files changed, 24 insertions, 0 deletions
diff --git a/spec/controllers/general_controller_spec.rb b/spec/controllers/general_controller_spec.rb index 4a7a0bb48..28dac7b96 100644 --- a/spec/controllers/general_controller_spec.rb +++ b/spec/controllers/general_controller_spec.rb @@ -53,6 +53,18 @@ describe GeneralController, 'when getting the blog feed' do end end + context 'when the blog has entries' do + + render_views + + it 'should escape any javascript from the entries' do + controller.stub!(:quietly_try_to_open).and_return(load_file_fixture("blog_feed.atom")) + get :blog + response.body.should_not include('<script>alert("exciting!")</script>') + end + + end + end describe GeneralController, "when showing the frontpage" do diff --git a/spec/controllers/request_controller_spec.rb b/spec/controllers/request_controller_spec.rb index 15e252501..2d3ccfa63 100644 --- a/spec/controllers/request_controller_spec.rb +++ b/spec/controllers/request_controller_spec.rb @@ -596,6 +596,18 @@ describe RequestController, "when showing one request" do response.status.should == 303 end + it "should sanitise HTML attachments" do + incoming_message = FactoryGirl.create(:incoming_message_with_html_attachment) + get :get_attachment, :incoming_message_id => incoming_message.id, + :id => incoming_message.info_request.id, + :part => 2, + :file_name => 'interesting.html', + :skip_cache => 1 + response.body.should_not match("script") + response.body.should_not match("interesting") + response.body.should match('dull') + end + it "should censor attachments downloaded as binary" do ir = info_requests(:fancy_dog_request) |