1 files changed, 112 insertions, 0 deletions
diff --git a/spec/helpers/emails_helper_spec.rb b/spec/helpers/emails_helper_spec.rb
index 96ac4015c77..ef8b342a3f6 100644
--- a/spec/helpers/emails_helper_spec.rb
+++ b/spec/helpers/emails_helper_spec.rb
@@ -361,4 +361,116 @@ RSpec.describe EmailsHelper do
       end
     end
   end
+
+  describe '#change_reviewer_notification_text' do
+    let(:mary) { build(:user, name: 'Mary') }
+    let(:john) { build(:user, name: 'John') }
+    let(:ted) { build(:user, name: 'Ted') }
+
+    context 'to new reviewers only' do
+      let(:previous_reviewers) { [] }
+      let(:new_reviewers) { [john] }
+
+      context 'with no html tag' do
+        let(:expected_output) do
+          'Reviewer changed to John'
+        end
+
+        it 'returns the expected output' do
+          expect(change_reviewer_notification_text(new_reviewers, previous_reviewers)).to eq(expected_output)
+        end
+      end
+
+      context 'with <strong> tag' do
+        let(:expected_output) do
+          'Reviewer changed to <strong>John</strong>'
+        end
+
+        it 'returns the expected output' do
+          expect(change_reviewer_notification_text(new_reviewers, previous_reviewers, :strong)).to eq(expected_output)
+        end
+      end
+    end
+
+    context 'from previous reviewers to new reviewers' do
+      let(:previous_reviewers) { [john, mary] }
+      let(:new_reviewers) { [ted] }
+
+      context 'with no html tag' do
+        let(:expected_output) do
+          'Reviewer changed from John and Mary to Ted'
+        end
+
+        it 'returns the expected output' do
+          expect(change_reviewer_notification_text(new_reviewers, previous_reviewers)).to eq(expected_output)
+        end
+      end
+
+      context 'with <strong> tag' do
+        let(:expected_output) do
+          'Reviewer changed from <strong>John and Mary</strong> to <strong>Ted</strong>'
+        end
+
+        it 'returns the expected output' do
+          expect(change_reviewer_notification_text(new_reviewers, previous_reviewers, :strong)).to eq(expected_output)
+        end
+      end
+    end
+
+    context 'from previous reviewers to no reviewers' do
+      let(:previous_reviewers) { [john, mary] }
+      let(:new_reviewers) { [] }
+
+      context 'with no html tag' do
+        let(:expected_output) do
+          'Reviewer changed from John and Mary to Unassigned'
+        end
+
+        it 'returns the expected output' do
+          expect(change_reviewer_notification_text(new_reviewers, previous_reviewers)).to eq(expected_output)
+        end
+      end
+
+      context 'with <strong> tag' do
+        let(:expected_output) do
+          'Reviewer changed from <strong>John and Mary</strong> to <strong>Unassigned</strong>'
+        end
+
+        it 'returns the expected output' do
+          expect(change_reviewer_notification_text(new_reviewers, previous_reviewers, :strong)).to eq(expected_output)
+        end
+      end
+    end
+
+    context "with a <script> tag in user's name" do
+      let(:previous_reviewers) { [] }
+      let(:new_reviewers) { [fishy_user] }
+      let(:fishy_user) { build(:user, name: "<script>alert('hi')</script>") }
+
+      let(:expected_output) do
+        'Reviewer changed to <strong>&lt;script&gt;alert(&#39;hi&#39;)&lt;/script&gt;</strong>'
+      end
+
+      it 'escapes the html tag' do
+        expect(change_reviewer_notification_text(new_reviewers, previous_reviewers, :strong)).to eq(expected_output)
+      end
+    end
+
+    context "with url in user's name" do
+      subject(:email_helper) { Object.new.extend(described_class) }
+
+      let(:previous_reviewers) { [] }
+      let(:new_reviewers) { [fishy_user] }
+      let(:fishy_user) { build(:user, name: "example.com") }
+
+      let(:expected_output) do
+        'Reviewer changed to example_com'
+      end
+
+      it "sanitizes user's name" do
+        expect(email_helper).to receive(:sanitize_name).and_call_original
+        expect(email_helper.change_reviewer_notification_text(new_reviewers, previous_reviewers)).to eq(expected_output)
+      end
+    end
+  end
 end