mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 11:02:33 -05:00
Lauri Ojansivu
339729fd95
- client/lib/tests/renderLinksPlainText.tests.js: the 'render links as plain text' toggle and XSS hardening. Config assertions (stripLinks adds <a> to FORBID_TAGS, default does not, KEEP_CONTENT) plus real sanitizeHTML() behavior: <a> stripped to its text when stripLinks, kept by default, and javascript: hrefs / event handlers / <script> removed regardless. - client/lib/tests/alwaysShowCodeAsText.tests.js: escapeHtmlSource (exposed on the Markdown export) escapes <script>/comments/quotes/ampersand-first so code is shown not executed; leaves plain text and empty strings unchanged. - server/lib/tests/impersonationReportQuery.tests.js: the Impersonation report search selector (extracted to models/lib/impersonationReportQuery.js so it is testable without re-registering the publication) builds a case-insensitive $or across the identity fields, escapes regex metacharacters, and is empty for a blank term. The MimeBleed fix (fileValidationBypass.security.tests.js), SortBleed (boards.security.tests.js) and import/export anonymization (importExportSecurity.tests.js) already carry positive + negative tests.
40 lines
1.5 KiB
JavaScript
40 lines
1.5 KiB
JavaScript
/* eslint-env mocha */
|
|
import { expect } from 'chai';
|
|
import { Markdown } from 'meteor/wekan-markdown';
|
|
|
|
// Tests for the Admin Panel / Features / Security "Always show all code as plain
|
|
// text" toggle. When enabled, the markdown helper renders the raw source escaped
|
|
// (via escapeHtmlSource) so hidden content — HTML comments, the target of markdown
|
|
// links, JavaScript and any other code — is shown literally, not executed. Here we
|
|
// pin escapeHtmlSource, the escaper that makes that safe.
|
|
describe('markdown — always show code as plain text (escapeHtmlSource)', function() {
|
|
const esc = Markdown.escapeHtmlSource;
|
|
|
|
it('escapes <script> so it is shown, not executed', function() {
|
|
expect(esc("<script>alert('x')</script>")).to.equal(
|
|
"<script>alert('x')</script>",
|
|
);
|
|
});
|
|
|
|
it('reveals HTML comments instead of hiding them', function() {
|
|
expect(esc('<!-- secret -->')).to.equal('<!-- secret -->');
|
|
});
|
|
|
|
it('escapes ampersand first so entities are not double-decoded', function() {
|
|
expect(esc('a & b')).to.equal('a & b');
|
|
expect(esc('<')).to.equal('&lt;');
|
|
});
|
|
|
|
it('escapes quotes used in markup attributes', function() {
|
|
expect(esc('<a href="x">')).to.equal('<a href="x">');
|
|
});
|
|
|
|
it('leaves plain text without HTML-significant characters unchanged (negative)', function() {
|
|
expect(esc('just plain text 123')).to.equal('just plain text 123');
|
|
});
|
|
|
|
it('leaves an empty string unchanged (negative)', function() {
|
|
expect(esc('')).to.equal('');
|
|
});
|
|
});
|