diff --git a/spec/views/admin/lodgings/index.html.haml_spec.rb b/spec/views/admin/lodgings/index.html.haml_spec.rb index 95f16be4..0c952f76 100644 --- a/spec/views/admin/lodgings/index.html.haml_spec.rb +++ b/spec/views/admin/lodgings/index.html.haml_spec.rb @@ -9,4 +9,14 @@ describe 'admin/lodgings/index' do render expect(rendered).to include(CGI.escapeHTML(@conference.lodgings.first.name)) end + + it 'prevents XSS in lodging description' do + @conference = create(:conference) + @conference.venue = create(:venue) + @conference.lodgings << create(:lodging_xss) + assign :venue, @conference.venue + render + expect(rendered).to_not have_selector("#divInjectedElement") + end + end