Testing if I can squash this way (#1)

* Fixed XSS resulting from markdown() method
This commit is contained in:
Chris Niedzwiedz 2017-01-09 12:27:11 -06:00 committed by GitHub
parent c552d08b8e
commit d2e177cac4
7 changed files with 61 additions and 1 deletions

View file

@ -9,4 +9,14 @@ describe 'admin/lodgings/index' do
render
expect(rendered).to include(CGI.escapeHTML(@conference.lodgings.first.name))
end
it 'prevents XSS in lodging description' do
@conference = create(:conference)
@conference.venue = create(:venue)
@conference.lodgings << create(:lodging_xss)
assign :venue, @conference.venue
render
expect(rendered).to_not have_selector('#divInjectedElement')
end
end