File tree Expand file tree Collapse file tree 2 files changed +11
-11
lines changed
helpers/better_together/content
views/better_together/content/blocks Expand file tree Collapse file tree 2 files changed +11
-11
lines changed Original file line number Diff line number Diff line change 1212# end
1313# end
1414# end
15- module BetterTogether
15+ module BetterTogether # rubocop:todo Metrics/ModuleLength
1616 RSpec . describe Content ::BlocksHelper do
1717 describe '#sanitize_block_css' do
1818 context 'with safe CSS' do
@@ -138,8 +138,8 @@ module BetterTogether
138138 end
139139
140140 describe '#temp_id_for' do
141- let ( :persisted_model ) { double ( 'Model' , persisted? : true , id : 123 ) }
142- let ( :new_model ) { double ( 'Model' , persisted? : false ) }
141+ let ( :persisted_model ) { double ( 'Model' , persisted? : true , id : 123 ) } # rubocop:todo RSpec/VerifiedDoubles
142+ let ( :new_model ) { double ( 'Model' , persisted? : false ) } # rubocop:todo RSpec/VerifiedDoubles
143143
144144 it 'returns model id for persisted models' do
145145 expect ( helper . temp_id_for ( persisted_model ) ) . to eq ( 123 )
Original file line number Diff line number Diff line change 33require 'rails_helper'
44
55module BetterTogether
6- module Content
7- RSpec . describe 'better_together/content/blocks/_css.html.erb' , type : :view do
6+ module Content # rubocop:todo Metrics/ModuleLength
7+ RSpec . describe 'better_together/content/blocks/_css.html.erb' do
88 let ( :platform ) { create ( :better_together_platform ) }
99 let ( :creator ) { create ( :better_together_person ) }
1010
@@ -180,19 +180,19 @@ module Content
180180 content_text : 'width: expression(alert("XSS")); color: red;' )
181181 end
182182
183+ let ( :css_with_javascript_url ) do
184+ create ( :better_together_content_css ,
185+ creator : creator ,
186+ content_text : 'background: url(javascript:alert("XSS"));' )
187+ end
188+
183189 it 'sanitizes dangerous expression() calls' do
184190 render partial : 'better_together/content/blocks/css' , locals : { css : css_with_expression }
185191
186192 expect ( rendered ) . not_to include ( 'expression(' )
187193 expect ( rendered ) . to include ( 'color: red;' )
188194 end
189195
190- let ( :css_with_javascript_url ) do
191- create ( :better_together_content_css ,
192- creator : creator ,
193- content_text : 'background: url(javascript:alert("XSS"));' )
194- end
195-
196196 it 'sanitizes javascript: URLs' do
197197 render partial : 'better_together/content/blocks/css' , locals : { css : css_with_javascript_url }
198198
You can’t perform that action at this time.
0 commit comments