liuxm/Mergely
1
0
Fork 0
forked from lxm_front/Mergely
Code Issues Pull Requests Projects Releases Wiki Activity

chore: updated dependencies

Browse Source
This commit is contained in:
Jamie Peabody
2020-10-15 20:46:11 +01:00
parent 5a0cd15ddd
commit 85b02add89
6 changed files with 76 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
tests/mergely.spec.js
View File

@@ -586,28 +586,48 @@ describe('mergely', function () {
done();
});
});
});
it('should not be vulnerable to XSS', function (done) {
function initXSS(options) {
$('body').get(0).innerHTML = "<!DOCTYPE html><html lang=\"en\"><body><div id='mergely<script id=\"injected\">alert(123)</script>'></div></body></html>";
const divs = document.getElementsByTagName('div');
editor = $(divs[0]);
editor.mergely(options);
return editor;
};
it('should not be vulnerable to XSS', function (done) {
function initXSS(options) {
$('body').get(0).innerHTML = "<!DOCTYPE html><html lang=\"en\"><body><div id='mergely<script id=\"injected\">alert(123)</script>'></div></body></html>";
const divs = document.getElementsByTagName('div');
editor = $(divs[0]);
editor.mergely(options);
return editor;
};
$(document).ready(() => {
const editor = initXSS({
height: 100,
viewport: true,
license: 'lgpl-separate-notice',
lhs: (setValue) => setValue(macbeth),
rhs: (setValue) => setValue(macbeth)
});
expect($('body').find('#injected')).to.have.length(0, 'expected no div with id injected');
const divs = document.getElementsByTagName('div');
expect(divs).to.have.length(1);
expect(divs[0].id).to.equal('mergely<script id="injected">alert(123)</script>');
$(document).ready(() => {
const editor = initXSS({
height: 100,
viewport: true,
license: 'lgpl-separate-notice',
lhs: (setValue) => setValue(macbeth),
rhs: (setValue) => setValue(macbeth)
});
expect($('body').find('#injected')).to.have.length(0, 'expected no div with id injected');
const divs = document.getElementsByTagName('div');
expect(divs).to.have.length(1);
expect(divs[0].id).to.equal('mergely<script id="injected">alert(123)</script>');
done();
});
});
it('should ignore accented characters', function (done) {
$(document).ready(() => {
const editor = init({
height: 100,
license: 'lgpl-separate-notice',
ignoreaccents: true,
lhs: (setValue) => setValue('comunicação'),
rhs: (setValue) => setValue('comunicacao')
});
const { mergely } = $('#mergely');
$('#mergely').on('updated', () => {
console.log('updated');
const diff = $('#mergely').mergely('diff');;
expect(diff).to.equal('');
done();
});
});