@@ -121,33 +121,34 @@ describe('svg+text utils', function() {
121
121
} ) ;
122
122
123
123
it ( 'wrap XSS attacks in href' , function ( ) {
124
- var textCases = [
125
- '<a href="XSS\" onmouseover="alert(1)\" style="font-size:300px">Subtitle</a>' ,
126
- '<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
127
- ] ;
124
+ var node = mockTextSVGElement (
125
+ '<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
126
+ ) ;
128
127
129
- textCases . forEach ( function ( textCase ) {
130
- var node = mockTextSVGElement ( textCase ) ;
128
+ expect ( node . text ( ) ) . toEqual ( 'Subtitle' ) ;
129
+ assertAnchorAttrs ( node ) ;
130
+ assertAnchorLink ( node , 'XSS onmouseover=alert(1) style=font-size:300px' ) ;
131
+ } ) ;
131
132
132
- expect ( node . text ( ) ) . toEqual ( 'Subtitle' ) ;
133
- assertAnchorAttrs ( node ) ;
134
- assertAnchorLink ( node , 'XSS onmouseover=alert(1) style=font-size:300px' ) ;
135
- } ) ;
133
+ it ( 'wrap XSS attacks with quoted entities in href' , function ( ) {
134
+ var node = mockTextSVGElement (
135
+ '<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
136
+ ) ;
137
+
138
+ console . log ( node . select ( 'a' ) . attr ( 'xlink:href' ) ) ;
139
+ expect ( node . text ( ) ) . toEqual ( 'Subtitle' ) ;
140
+ assertAnchorAttrs ( node ) ;
141
+ assertAnchorLink ( node , 'XSS" onmouseover="alert(1)" style="font-size:300px' ) ;
136
142
} ) ;
137
143
138
144
it ( 'should keep query parameters in href' , function ( ) {
139
- var textCases = [
140
- '<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>' ,
141
- '<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>'
142
- ] ;
143
-
144
- textCases . forEach ( function ( textCase ) {
145
- var node = mockTextSVGElement ( textCase ) ;
145
+ var node = mockTextSVGElement (
146
+ '<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>'
147
+ ) ;
146
148
147
- assertAnchorAttrs ( node ) ;
148
- expect ( node . text ( ) ) . toEqual ( 'abc.com?shared-key' ) ;
149
- assertAnchorLink ( node , 'https://abc.com/myFeature.jsp?name=abc&pwd=def' ) ;
150
- } ) ;
149
+ assertAnchorAttrs ( node ) ;
150
+ expect ( node . text ( ) ) . toEqual ( 'abc.com?shared-key' ) ;
151
+ assertAnchorLink ( node , 'https://abc.com/myFeature.jsp?name=abc&pwd=def' ) ;
151
152
} ) ;
152
153
153
154
it ( 'allow basic spans' , function ( ) {
0 commit comments