summaryrefslogtreecommitdiff
path: root/spec/features/markdown/math_spec.rb
diff options
context:
space:
mode:
Diffstat (limited to 'spec/features/markdown/math_spec.rb')
-rw-r--r--spec/features/markdown/math_spec.rb22
1 files changed, 19 insertions, 3 deletions
diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb
index 6a23d6b78ab..53abb5e3722 100644
--- a/spec/features/markdown/math_spec.rb
+++ b/spec/features/markdown/math_spec.rb
@@ -1,6 +1,8 @@
require 'spec_helper'
describe 'Math rendering', :js do
+ let!(:project) { create(:project, :public) }
+
it 'renders inline and display math correctly' do
description = <<~MATH
This math is inline $`a^2+b^2=c^2`$.
@@ -11,12 +13,26 @@ describe 'Math rendering', :js do
```
MATH
- project = create(:project, :public)
issue = create(:issue, project: project, description: description)
visit project_issue_path(project, issue)
- expect(page).to have_selector('.katex .mord.mathit', text: 'b')
- expect(page).to have_selector('.katex-display .mord.mathit', text: 'b')
+ expect(page).to have_selector('.katex .mord.mathdefault', text: 'b')
+ expect(page).to have_selector('.katex-display .mord.mathdefault', text: 'b')
+ end
+
+ it 'only renders non XSS links' do
+ description = <<~MATH
+ This link is valid $`\\href{javascript:alert('xss');}{xss}`$.
+
+ This link is valid $`\\href{https://gitlab.com}{Gitlab}`$.
+ MATH
+
+ issue = create(:issue, project: project, description: description)
+
+ visit project_issue_path(project, issue)
+
+ expect(page).to have_selector('.katex-error', text: "\href{javascript:alert('xss');}{xss}")
+ expect(page).to have_selector('.katex-html a', text: 'Gitlab')
end
end