IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FEATURE: allows html tooltips (#6665)

Browse Source
This commit is contained in:
Joffrey JAFFEUX
2018-11-26 11:15:23 +01:00
committed by GitHub
parent e47b478b83
commit 3453707784
2 changed files with 57 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
test/javascripts/lib/tooltip-test.js.es6
View File

@@ -4,22 +4,56 @@ import { registerTooltip } from "discourse/lib/tooltip";
QUnit.module("lib:tooltip", {
beforeEach() {
fixture().html(
"<a class='test-link' data-tooltip='XSS<s onmouseover\=alert(document.domain)>XSS'>test</a>"
`
<a class='test-text-link' data-tooltip='XSS<s onmouseover\=alert(document.domain)>XSS'>test</a>
<a class='test-html-link' data-html-tooltip='<p>test</p>'>test</a>
`
);
}
});
QUnit.test("it prevents XSS injection", assert => {
const $testLink = fixture(".test-link");
registerTooltip($testLink);
$testLink.click();
QUnit.test("text support", async assert => {
const $testTextLink = fixture(".test-text-link");
registerTooltip($testTextLink);
andThen(() => {
assert.equal(
fixture(".tooltip-content")
.html()
.trim(),
"XSS&lt;s onmouseover=alert(document.domain)&gt;XSS"
);
});
await $testTextLink.click();
assert.equal(
fixture(".tooltip-content")
.html()
.trim(),
"XSS&lt;s onmouseover=alert(document.domain)&gt;XSS",
"it prevents XSS injection"
);
assert.equal(
fixture(".tooltip-content")
.text()
.trim(),
"XSS<s onmouseover=alert(document.domain)>XSS",
"it returns content as plain text"
);
});
QUnit.test("html support", async assert => {
const $testHtmlLink = fixture(".test-html-link");
registerTooltip($testHtmlLink);
await $testHtmlLink.click();
assert.equal(
fixture(".tooltip-content")
.html()
.trim(),
"<p>test</p>",
"it doesn’t escape HTML"
);
assert.equal(
fixture(".tooltip-content")
.text()
.trim(),
"test",
"it returns content as plain text"
);
});