@@ -121,33 +121,34 @@ describe('svg+text utils', function() {
121121 } ) ;
122122
123123 it ( 'wrap XSS attacks in href' , function ( ) {
124- var textCases = [
125- '<a href="XSS\" onmouseover="alert(1)\" style="font-size:300px">Subtitle</a>' ,
126- '<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
127- ] ;
124+ var node = mockTextSVGElement (
125+ '<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
126+ ) ;
128127
129- textCases . forEach ( function ( textCase ) {
130- var node = mockTextSVGElement ( textCase ) ;
128+ expect ( node . text ( ) ) . toEqual ( 'Subtitle' ) ;
129+ assertAnchorAttrs ( node ) ;
130+ assertAnchorLink ( node , 'XSS onmouseover=alert(1) style=font-size:300px' ) ;
131+ } ) ;
131132
132- expect ( node . text ( ) ) . toEqual ( 'Subtitle' ) ;
133- assertAnchorAttrs ( node ) ;
134- assertAnchorLink ( node , 'XSS onmouseover=alert(1) style=font-size:300px' ) ;
135- } ) ;
133+ it ( 'wrap XSS attacks with quoted entities in href' , function ( ) {
134+ var node = mockTextSVGElement (
135+ '<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
136+ ) ;
137+
138+ console . log ( node . select ( 'a' ) . attr ( 'xlink:href' ) ) ;
139+ expect ( node . text ( ) ) . toEqual ( 'Subtitle' ) ;
140+ assertAnchorAttrs ( node ) ;
141+ assertAnchorLink ( node , 'XSS" onmouseover="alert(1)" style="font-size:300px' ) ;
136142 } ) ;
137143
138144 it ( 'should keep query parameters in href' , function ( ) {
139- var textCases = [
140- '<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>' ,
141- '<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>'
142- ] ;
143-
144- textCases . forEach ( function ( textCase ) {
145- var node = mockTextSVGElement ( textCase ) ;
145+ var node = mockTextSVGElement (
146+ '<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>'
147+ ) ;
146148
147- assertAnchorAttrs ( node ) ;
148- expect ( node . text ( ) ) . toEqual ( 'abc.com?shared-key' ) ;
149- assertAnchorLink ( node , 'https://abc.com/myFeature.jsp?name=abc&pwd=def' ) ;
150- } ) ;
149+ assertAnchorAttrs ( node ) ;
150+ expect ( node . text ( ) ) . toEqual ( 'abc.com?shared-key' ) ;
151+ assertAnchorLink ( node , 'https://abc.com/myFeature.jsp?name=abc&pwd=def' ) ;
151152 } ) ;
152153
153154 it ( 'allow basic spans' , function ( ) {
0 commit comments