From 025f1752768114183bd2644e9583e66d4cfbf8ed Mon Sep 17 00:00:00 2001 From: chrniedz Date: Fri, 6 Jan 2017 17:15:50 -0600 Subject: [PATCH] Fixed XSS from markdown() --- spec/views/admin/lodgings/index.html.haml_spec.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/spec/views/admin/lodgings/index.html.haml_spec.rb b/spec/views/admin/lodgings/index.html.haml_spec.rb index 95f16be4..0c952f76 100644 --- a/spec/views/admin/lodgings/index.html.haml_spec.rb +++ b/spec/views/admin/lodgings/index.html.haml_spec.rb @@ -9,4 +9,14 @@ describe 'admin/lodgings/index' do render expect(rendered).to include(CGI.escapeHTML(@conference.lodgings.first.name)) end + + it 'prevents XSS in lodging description' do + @conference = create(:conference) + @conference.venue = create(:venue) + @conference.lodgings << create(:lodging_xss) + assign :venue, @conference.venue + render + expect(rendered).to_not have_selector("#divInjectedElement") + end + end