require File.expand_path('spec/spec_helper') describe Whitewash do it "loads default whitelist" do whitelist = Whitewash.default_whitelist whitelist.should be_a_kind_of Hash whitelist.should include '_css' end it "drops and elements" do w = Whitewash.new input = '

test

' output = w.sanitize(input) output.should == '

test

' end it "understands fragments with multiple root elements" do w = Whitewash.new input = '

foo

bar

' output = w.sanitize(input) output.should == '

foo

bar

' end it "removes buzz

' output = w.sanitize(input) output.should == '

foo buzz

' end it "removes onclick attribute" do w = Whitewash.new input = '

foo bar buzz

' output = w.sanitize(input) output.should == '

foo bar buzz

' end it "removes background CSS property" do w = Whitewash.new input = '

foo bar buzz

' output = w.sanitize(input) output.should == '

foo bar buzz

' end it "rewrites HTML when supplied with a block" do w = Whitewash.new input = '

foo buzz

' output = w.sanitize(input) do |xml| if xml.name == 'img' xml['src'] = 'out.jpg' end end output.should == '

foo buzz

' end it "fixes up invalid markup" do w = Whitewash.new input = '

foo bar buzz

' output = w.sanitize(input) output.should == '

foo bar buzz

' end # http://ha.ckers.org/xss.html it "catches javascript: in img/src" do w = Whitewash.new input = %q{

} output = w.sanitize(input) output.should == %q{} end it "handles strings with null in the middle" do w = Whitewash.new input = %q{

} output = w.sanitize(input) output.should == %q{} end it "handles extra open brackets" do w = Whitewash.new input = %q{<} output = w.sanitize(input) output.should == '

alert("XSS");//

' end it "removes remote stylesheet link" do w = Whitewash.new input = %q{

} output = w.sanitize(input) output.should == '

' end it "removes XML data island with CDATA obfuscation" do w = Whitewash.new input = %{]]> } output = w.sanitize(input) output.should == ']]> ' end end