summaryrefslogtreecommitdiff
path: root/spec/features/issues/user_comments_on_issue_spec.rb
diff options
context:
space:
mode:
Diffstat (limited to 'spec/features/issues/user_comments_on_issue_spec.rb')
-rw-r--r--spec/features/issues/user_comments_on_issue_spec.rb5
1 files changed, 3 insertions, 2 deletions
diff --git a/spec/features/issues/user_comments_on_issue_spec.rb b/spec/features/issues/user_comments_on_issue_spec.rb
index b4b9a589ba3..4b29f6ee42a 100644
--- a/spec/features/issues/user_comments_on_issue_spec.rb
+++ b/spec/features/issues/user_comments_on_issue_spec.rb
@@ -41,16 +41,17 @@ describe "User comments on issue", :js do
expect(page.find('pre code').text).to eq code_block_content
end
- it "does not render html content in mermaid" do
+ it "renders escaped HTML content in Mermaid" do
html_content = "<img onerror=location=`javascript\\u003aalert\\u0028document.domain\\u0029` src=x>"
mermaid_content = "graph LR\n B-->D(#{html_content});"
+ escaped_content = CGI.escapeHTML(html_content).gsub('=', "&equals;")
comment = "```mermaid\n#{mermaid_content}\n```"
add_note(comment)
wait_for_requests
- expect(page.find('svg.mermaid')).to have_content html_content
+ expect(page.find('svg.mermaid')).to have_content escaped_content
end
end