@@ -190,7 +190,38 @@ describe('svg+text utils', function() {
190190 it ( 'attaches onclick if popup is specified' , function ( ) {
191191 var node = mockTextSVGElement ( '<a href="x" target="fred" popup="width=500,height=400">link</a>' ) ;
192192 assertAnchorLink ( node , 'x' , 'fred' , 'new' ) ;
193- assertAnchorAttrs ( node , { onclick : 'window.open("x","fred","width=500,height=400");return false;' } ) ;
193+ assertAnchorAttrs ( node , { onclick : 'window.open(this.href.baseVal,this.target.baseVal,"width=500,height=400");return false;' } ) ;
194+ } ) ;
195+
196+ it ( 'drops XSS attacks via popup script' , function ( ) {
197+ var textCases = [
198+ [
199+ '<a href=\'#\' target=\'b\' popup=\'1");alert(document.cookie);//\'>XSS</a>' ,
200+ '#' , 'b' , null
201+ ] ,
202+ [
203+ '<a href=\'#\' target=\'b");alert(document.cookie);//\' popup=\'1\'>XSS</a>' ,
204+ '#' , 'b");alert(document.cookie);//' , '1'
205+ ] ,
206+ [
207+ '<a href=\'#");alert(document.cookie);//\' target=\'b\' popup=\'1\'>XSS</a>' ,
208+ '#%22);alert(document.cookie);//' , 'b' , '1'
209+ ]
210+ ] ;
211+
212+ textCases . forEach ( function ( textCase ) {
213+ var node = mockTextSVGElement ( textCase [ 0 ] ) ;
214+
215+ var attrs = { } ;
216+ if ( textCase [ 3 ] ) {
217+ attrs . onclick = 'window.open(this.href.baseVal,this.target.baseVal,"' +
218+ textCase [ 3 ] + '");return false;' ;
219+ }
220+
221+ expect ( node . text ( ) ) . toEqual ( 'XSS' ) ;
222+ assertAnchorAttrs ( node , attrs , textCase [ 0 ] ) ;
223+ assertAnchorLink ( node , textCase [ 1 ] , textCase [ 2 ] , 'new' , textCase [ 0 ] ) ;
224+ } ) ;
194225 } ) ;
195226
196227 it ( 'keeps query parameters in href' , function ( ) {
0 commit comments