# encoding: utf-8 require_relative 'common' # Miscellaneous attempts to sneak maliciously crafted HTML past Sanitize. Many # of these are courtesy of (or inspired by) the OWASP XSS Filter Evasion Cheat # Sheet. # # https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet describe 'Malicious HTML' do make_my_diffs_pretty! parallelize_me! before do @s = Sanitize.new(Sanitize::Config::RELAXED) end describe 'comments' do it 'should not allow script injection via conditional comments' do _(@s.fragment(%[])). must_equal '' end end describe 'interpolation (ERB, PHP, etc.)' do it 'should escape ERB-style tags' do _(@s.fragment('<% naughty_ruby_code %>')). must_equal '<% naughty_ruby_code %>' _(@s.fragment('<%= naughty_ruby_code %>')). must_equal '<%= naughty_ruby_code %>' end it 'should remove PHP-style tags' do _(@s.fragment('')). must_equal '' _(@s.fragment('')). must_equal '' end end describe '' do it 'should not be possible to inject JS via a malformed event attribute' do _(@s.document('')). must_equal "" end end describe '