From f6670aecfdbe59729882e919388808b240f7ec2d Mon Sep 17 00:00:00 2001
From: Penar Musaraj <pmusaraj@gmail.com>
Date: Tue, 16 May 2023 11:06:05 -0400
Subject: [PATCH] DEV: Fix preview sanitization test (#21521)

This test was passing, but the environment it was testing was incorrect.
The `image-controls` markdown rule allowlists several svgs when previewing.
But since `previewing: true` is only set on the parent `ComposerEditor`
component, the test in `DEditor` wasn't aware of that, so the output was
ignoring the `previewing` option.

This moves the test one level higher, to `ComposerEditor`, and because
now `previewing: true` is correctly used, it updates the test to show
that the svg element is present, but an `onload` attributes is stripped.
---
 .../components/composer-editor-test.js        | 19 +++++++++++++++++++
 .../integration/components/d-editor-test.js   | 10 ----------
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/app/assets/javascripts/discourse/tests/integration/components/composer-editor-test.js b/app/assets/javascripts/discourse/tests/integration/components/composer-editor-test.js
index 28405f9cd36..f652474fb8e 100644
--- a/app/assets/javascripts/discourse/tests/integration/components/composer-editor-test.js
+++ b/app/assets/javascripts/discourse/tests/integration/components/composer-editor-test.js
@@ -3,6 +3,7 @@ import { setupRenderingTest } from "discourse/tests/helpers/component-test";
 import { fillIn, render } from "@ember/test-helpers";
 import { hbs } from "ember-cli-htmlbars";
 import pretender, { response } from "discourse/tests/helpers/create-pretender";
+import { query } from "discourse/tests/helpers/qunit-helpers";
 
 module("Integration | Component | ComposerEditor", function (hooks) {
   setupRenderingTest(hooks);
@@ -43,4 +44,22 @@ module("Integration | Component | ComposerEditor", function (hooks) {
 
     await fillIn("textarea", "@user-no @user-ok @user-nope");
   });
+
+  test("preview sanitizes HTML", async function (assert) {
+    this.set("model", {});
+    this.set("noop", () => {});
+
+    await render(hbs`
+      <ComposerEditor
+        @composer={{this.model}}
+        @afterRefresh={{this.noop}}
+      />
+    `);
+
+    await fillIn(".d-editor-input", `"><svg onload="prompt(/xss/)"></svg>`);
+    assert.strictEqual(
+      query(".d-editor-preview").innerHTML.trim(),
+      '<p>"&gt;<svg></svg></p>'
+    );
+  });
 });
diff --git a/app/assets/javascripts/discourse/tests/integration/components/d-editor-test.js b/app/assets/javascripts/discourse/tests/integration/components/d-editor-test.js
index 3a6fbdbf8f7..c5bfaa81b71 100644
--- a/app/assets/javascripts/discourse/tests/integration/components/d-editor-test.js
+++ b/app/assets/javascripts/discourse/tests/integration/components/d-editor-test.js
@@ -45,16 +45,6 @@ module("Integration | Component | d-editor", function (hooks) {
     );
   });
 
-  test("preview sanitizes HTML", async function (assert) {
-    await render(hbs`<DEditor @value={{this.value}} />`);
-
-    await fillIn(".d-editor-input", `"><svg onload="prompt(/xss/)"></svg>`);
-    assert.strictEqual(
-      query(".d-editor-preview").innerHTML.trim(),
-      '<p>"&gt;</p>'
-    );
-  });
-
   test("updating the value refreshes the preview", async function (assert) {
     this.set("value", "evil trout");