Unfloyded/Legamunt
0
0
Fork 0
Code Activity

[!] Sanitize incoming classlist properly (#6162)

Browse source 
* Sanitize classlist properly

* Actually properly sanitize every class after the first

* Improve Formatter spec to check for multiple classes and non-space whitespace
This commit is contained in:
puckipedia 2018-01-03 03:54:08 +01:00 • committed by Eugen Rochko
parent d319b3dbe4
commit 545095b3ce
2 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
spec/lib/formatter_spec.rb
View file

@ -332,7 +332,7 @@ RSpec.describe Formatter do
end
context 'contains malicious classes' do
let(:text) { '<span class="status__content__spoiler-link">Show more</span>' }
let(:text) { '<span class="mention status__content__spoiler-link">Show more</span>' }
it 'strips malicious classes' do
is_expected.to_not include 'status__content__spoiler-link'