|
@ -223,7 +223,7 @@ RSpec.describe TextFormatter do |
|
|
end |
|
|
end |
|
|
|
|
|
|
|
|
context 'given a URL containing unsafe code (XSS attack, visible part)' do |
|
|
context 'given a URL containing unsafe code (XSS attack, visible part)' do |
|
|
let(:text) { %q{http://example.com/b<del>b</del>} } |
|
|
|
|
|
|
|
|
let(:text) { 'http://example.com/b<del>b</del>' } |
|
|
|
|
|
|
|
|
it 'does not include the HTML in the URL' do |
|
|
it 'does not include the HTML in the URL' do |
|
|
is_expected.to include '"http://example.com/b"' |
|
|
is_expected.to include '"http://example.com/b"' |
|
@ -235,7 +235,7 @@ RSpec.describe TextFormatter do |
|
|
end |
|
|
end |
|
|
|
|
|
|
|
|
context 'given a URL containing unsafe code (XSS attack, invisible part)' do |
|
|
context 'given a URL containing unsafe code (XSS attack, invisible part)' do |
|
|
let(:text) { %q{http://example.com/blahblahblahblah/a<script>alert("Hello")</script>} } |
|
|
|
|
|
|
|
|
let(:text) { 'http://example.com/blahblahblahblah/a<script>alert("Hello")</script>' } |
|
|
|
|
|
|
|
|
it 'does not include the HTML in the URL' do |
|
|
it 'does not include the HTML in the URL' do |
|
|
is_expected.to include '"http://example.com/blahblahblahblah/a"' |
|
|
is_expected.to include '"http://example.com/blahblahblahblah/a"' |
|
|