From a42240b5a6e3920c72c340226962690967873929 Mon Sep 17 00:00:00 2001
From: chrniedz <chrniedz@cisco.com>
Date: Fri, 6 Jan 2017 16:58:18 -0600
Subject: [PATCH] Fixed XSS resulting from markdown() method

---
 spec/views/proposals/show.html.haml_spec.rb | 20 ++++++++++++++++++++
 spec/views/users/show.html.haml_spec.rb     | 17 +++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 spec/views/proposals/show.html.haml_spec.rb
 create mode 100644 spec/views/users/show.html.haml_spec.rb

diff --git a/spec/views/proposals/show.html.haml_spec.rb b/spec/views/proposals/show.html.haml_spec.rb
new file mode 100644
index 00000000..c62a513a
--- /dev/null
+++ b/spec/views/proposals/show.html.haml_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper'
+
+describe 'proposals/show' do
+  let!(:conference) { create(:conference) }
+  let!(:event) { create(:event_xss, program: conference.program, title: 'event1', language: 'English') }
+  let(:organizer_role) { Role.find_by(name: 'organizer', resource: conference) }
+  let(:organizer) { create(:user, name: 'test name', email: 'test@email.osem', role_ids: [organizer_role.id]) }
+
+  it 'renders proposal information' do
+    sign_in organizer
+
+    assign :conference, conference
+    assign :event, event
+    assign :speaker, organizer
+
+    render template: 'proposals/show.html.haml'
+
+    expect(rendered).to_not have_selector("#divInjectedElement")
+  end
+end
diff --git a/spec/views/users/show.html.haml_spec.rb b/spec/views/users/show.html.haml_spec.rb
new file mode 100644
index 00000000..83d0d4b5
--- /dev/null
+++ b/spec/views/users/show.html.haml_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe 'users/show' do
+  let!(:conference) { create(:conference) }
+  let(:organizer_role) { Role.find_by(name: 'organizer', resource: conference) }
+  let(:organizer) { create(:user_xss, name: 'test name', email: 'test@email.osem', role_ids: [organizer_role.id]) }
+
+  it 'renders proposal information' do
+    sign_in organizer
+
+    assign :user, organizer
+
+    render template: 'users/show.html.haml'
+
+    expect(rendered).to_not have_selector("#divInjectedElement")
+  end
+end