|
@@ -18,44 +18,44 @@ describe("XSS", function () {
|
|
|
|
|
|
let message = "<img src=x onerror=alert('XSS');>";
|
|
let message = "<img src=x onerror=alert('XSS');>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- let msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ let msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x onerror=alert('XSS');>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x onerror=alert('XSS');>");
|
|
expect(window.alert).not.toHaveBeenCalled();
|
|
expect(window.alert).not.toHaveBeenCalled();
|
|
|
|
|
|
message = "<img src=x onerror=alert('XSS')//";
|
|
message = "<img src=x onerror=alert('XSS')//";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x onerror=alert('XSS')//");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x onerror=alert('XSS')//");
|
|
|
|
|
|
message = "<img src=x onerror=alert(String.fromCharCode(88,83,83));>";
|
|
message = "<img src=x onerror=alert(String.fromCharCode(88,83,83));>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x onerror=alert(String.fromCharCode(88,83,83));>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x onerror=alert(String.fromCharCode(88,83,83));>");
|
|
|
|
|
|
message = "<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>";
|
|
message = "<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x oneonerrorrror=alert(String.fromCharCode(88,83,83));>");
|
|
|
|
|
|
message = "<img src=x:alert(alt) onerror=eval(src) alt=xss>";
|
|
message = "<img src=x:alert(alt) onerror=eval(src) alt=xss>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x:alert(alt) onerror=eval(src) alt=xss>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<img src=x:alert(alt) onerror=eval(src) alt=xss>");
|
|
|
|
|
|
message = "><img src=x onerror=alert('XSS');>";
|
|
message = "><img src=x onerror=alert('XSS');>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("><img src=x onerror=alert('XSS');>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("><img src=x onerror=alert('XSS');>");
|
|
|
|
|
|
message = "><img src=x onerror=alert(String.fromCharCode(88,83,83));>";
|
|
message = "><img src=x onerror=alert(String.fromCharCode(88,83,83));>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("><img src=x onerror=alert(String.fromCharCode(88,83,83));>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("><img src=x onerror=alert(String.fromCharCode(88,83,83));>");
|
|
|
|
|
|
@@ -74,43 +74,43 @@ describe("XSS", function () {
|
|
|
|
|
|
let message = "<svgonload=alert(1)>";
|
|
let message = "<svgonload=alert(1)>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- let msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ let msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual('<svgonload=alert(1)>');
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual('<svgonload=alert(1)>');
|
|
|
|
|
|
message = "<svg/onload=alert('XSS')>";
|
|
message = "<svg/onload=alert('XSS')>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg/onload=alert('XSS')>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg/onload=alert('XSS')>");
|
|
|
|
|
|
message = "<svg onload=alert(1)//";
|
|
message = "<svg onload=alert(1)//";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg onload=alert(1)//");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg onload=alert(1)//");
|
|
|
|
|
|
message = "<svg/onload=alert(String.fromCharCode(88,83,83))>";
|
|
message = "<svg/onload=alert(String.fromCharCode(88,83,83))>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg/onload=alert(String.fromCharCode(88,83,83))>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg/onload=alert(String.fromCharCode(88,83,83))>");
|
|
|
|
|
|
message = "<svg id=alert(1) onload=eval(id)>";
|
|
message = "<svg id=alert(1) onload=eval(id)>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg id=alert(1) onload=eval(id)>");
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual("<svg id=alert(1) onload=eval(id)>");
|
|
|
|
|
|
message = '"><svg/onload=alert(String.fromCharCode(88,83,83))>';
|
|
message = '"><svg/onload=alert(String.fromCharCode(88,83,83))>';
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual('"><svg/onload=alert(String.fromCharCode(88,83,83))>');
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual('"><svg/onload=alert(String.fromCharCode(88,83,83))>');
|
|
|
|
|
|
message = '"><svg/onload=alert(/XSS/)';
|
|
message = '"><svg/onload=alert(/XSS/)';
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual('"><svg/onload=alert(/XSS/)');
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual('"><svg/onload=alert(/XSS/)');
|
|
|
|
|
|
@@ -131,7 +131,7 @@ describe("XSS", function () {
|
|
let message = "http://www.opkode.com/'onmouseover='alert(1)'whatever";
|
|
let message = "http://www.opkode.com/'onmouseover='alert(1)'whatever";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
|
|
|
|
- let msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ let msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.innerHTML.replace(/<!---->/g, ''))
|
|
expect(msg.innerHTML.replace(/<!---->/g, ''))
|
|
.toEqual('http://www.opkode.com/\'onmouseover=\'alert(1)\'whatever');
|
|
.toEqual('http://www.opkode.com/\'onmouseover=\'alert(1)\'whatever');
|
|
@@ -140,34 +140,34 @@ describe("XSS", function () {
|
|
|
|
|
|
message = 'http://www.opkode.com/"onmouseover="alert(1)"whatever';
|
|
message = 'http://www.opkode.com/"onmouseover="alert(1)"whatever';
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
'<a target="_blank" rel="noopener" href="http://www.opkode.com/%22onmouseover=%22alert%281%29%22whatever">http://www.opkode.com/"onmouseover="alert(1)"whatever</a>');
|
|
'<a target="_blank" rel="noopener" href="http://www.opkode.com/%22onmouseover=%22alert%281%29%22whatever">http://www.opkode.com/"onmouseover="alert(1)"whatever</a>');
|
|
|
|
|
|
message = "https://en.wikipedia.org/wiki/Ender's_Game";
|
|
message = "https://en.wikipedia.org/wiki/Ender's_Game";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') === '<a target="_blank" rel="noopener" href="https://en.wikipedia.org/wiki/Ender%27s_Game">'+message+'</a>');
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') === '<a target="_blank" rel="noopener" href="https://en.wikipedia.org/wiki/Ender%27s_Game">'+message+'</a>');
|
|
|
|
|
|
message = "<https://bugs.documentfoundation.org/show_bug.cgi?id=123737>";
|
|
message = "<https://bugs.documentfoundation.org/show_bug.cgi?id=123737>";
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
`<<a target="_blank" rel="noopener" href="https://bugs.documentfoundation.org/show_bug.cgi?id=123737">https://bugs.documentfoundation.org/show_bug.cgi?id=123737</a>>`);
|
|
`<<a target="_blank" rel="noopener" href="https://bugs.documentfoundation.org/show_bug.cgi?id=123737">https://bugs.documentfoundation.org/show_bug.cgi?id=123737</a>>`);
|
|
|
|
|
|
message = '<http://www.opkode.com/"onmouseover="alert(1)"whatever>';
|
|
message = '<http://www.opkode.com/"onmouseover="alert(1)"whatever>';
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
'<<a target="_blank" rel="noopener" href="http://www.opkode.com/%22onmouseover=%22alert%281%29%22whatever">http://www.opkode.com/"onmouseover="alert(1)"whatever</a>>');
|
|
'<<a target="_blank" rel="noopener" href="http://www.opkode.com/%22onmouseover=%22alert%281%29%22whatever">http://www.opkode.com/"onmouseover="alert(1)"whatever</a>>');
|
|
|
|
|
|
message = `https://www.google.com/maps/place/Kochstraat+6,+2041+CE+Zandvoort/@52.3775999,4.548971,3a,15y,170.85h,88.39t/data=!3m6!1e1!3m4!1sQ7SdHo_bPLPlLlU8GSGWaQ!2e0!7i13312!8i6656!4m5!3m4!1s0x47c5ec1e56f845ad:0x1de0bc4a5771fb08!8m2!3d52.3773668!4d4.5489388!5m1!1e2`
|
|
message = `https://www.google.com/maps/place/Kochstraat+6,+2041+CE+Zandvoort/@52.3775999,4.548971,3a,15y,170.85h,88.39t/data=!3m6!1e1!3m4!1sQ7SdHo_bPLPlLlU8GSGWaQ!2e0!7i13312!8i6656!4m5!3m4!1s0x47c5ec1e56f845ad:0x1de0bc4a5771fb08!8m2!3d52.3773668!4d4.5489388!5m1!1e2`
|
|
await mock.sendMessage(view, message);
|
|
await mock.sendMessage(view, message);
|
|
- msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(message);
|
|
expect(msg.textContent).toEqual(message);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') ===
|
|
`<a target="_blank" rel="noopener" href="https://www.google.com/maps/place/Kochstraat+6,+2041+CE+Zandvoort/@52.3775999,4.548971,3a,15y,170.85h,88.39t/data=%213m6%211e1%213m4%211sQ7SdHo_bPLPlLlU8GSGWaQ%212e0%217i13312%218i6656%214m5%213m4%211s0x47c5ec1e56f845ad:0x1de0bc4a5771fb08%218m2%213d52.3773668%214d4.5489388%215m1%211e2">https://www.google.com/maps/place/Kochstraat+6,+2041+CE+Zandvoort/@52.3775999,4.548971,3a,15y,170.85h,88.39t/data=!3m6!1e1!3m4!1sQ7SdHo_bPLPlLlU8GSGWaQ!2e0!7i13312!8i6656!4m5!3m4!1s0x47c5ec1e56f845ad:0x1de0bc4a5771fb08!8m2!3d52.3773668!4d4.5489388!5m1!1e2</a>`);
|
|
`<a target="_blank" rel="noopener" href="https://www.google.com/maps/place/Kochstraat+6,+2041+CE+Zandvoort/@52.3775999,4.548971,3a,15y,170.85h,88.39t/data=%213m6%211e1%213m4%211sQ7SdHo_bPLPlLlU8GSGWaQ%212e0%217i13312%218i6656%214m5%213m4%211s0x47c5ec1e56f845ad:0x1de0bc4a5771fb08%218m2%213d52.3773668%214d4.5489388%215m1%211e2">https://www.google.com/maps/place/Kochstraat+6,+2041+CE+Zandvoort/@52.3775999,4.548971,3a,15y,170.85h,88.39t/data=!3m6!1e1!3m4!1sQ7SdHo_bPLPlLlU8GSGWaQ!2e0!7i13312!8i6656!4m5!3m4!1s0x47c5ec1e56f845ad:0x1de0bc4a5771fb08!8m2!3d52.3773668!4d4.5489388!5m1!1e2</a>`);
|
|
@@ -210,19 +210,19 @@ describe("XSS", function () {
|
|
}];
|
|
}];
|
|
|
|
|
|
function checkNonParsedURL (url) {
|
|
function checkNonParsedURL (url) {
|
|
- const msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ const msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(url);
|
|
expect(msg.textContent).toEqual(url);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual(url);
|
|
expect(msg.innerHTML.replace(/<!---->/g, '')).toEqual(url);
|
|
}
|
|
}
|
|
|
|
|
|
async function checkParsedURL ({ entered, href }) {
|
|
async function checkParsedURL ({ entered, href }) {
|
|
- const msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ const msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent).toEqual(entered);
|
|
expect(msg.textContent).toEqual(entered);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') === `<a target="_blank" rel="noopener" href="${href}">${entered}</a>`);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '') === `<a target="_blank" rel="noopener" href="${href}">${entered}</a>`);
|
|
}
|
|
}
|
|
|
|
|
|
async function checkParsedXMPPURL ({ entered, href }) {
|
|
async function checkParsedXMPPURL ({ entered, href }) {
|
|
- const msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view.el).pop();
|
|
|
|
|
|
+ const msg = sizzle('.chat-content .chat-msg:last .chat-msg__text', view).pop();
|
|
expect(msg.textContent.trim()).toEqual(entered);
|
|
expect(msg.textContent.trim()).toEqual(entered);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '').trim() === `<a target="_blank" rel="noopener" href="${href}">${entered}</a>`);
|
|
await u.waitUntil(() => msg.innerHTML.replace(/<!---->/g, '').trim() === `<a target="_blank" rel="noopener" href="${href}">${entered}</a>`);
|
|
}
|
|
}
|