From 09ce4671848d79cff64a81c49c374abb281d6d94 Mon Sep 17 00:00:00 2001
From: Lin Jen-Shin <godfat@godfat.org>
Date: Tue, 27 Mar 2018 01:54:30 +0800
Subject: Add a test to make sure there's no XSS for hook logs

---
 .../projects/hook_logs/user_reads_log_spec.rb       | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 spec/features/projects/hook_logs/user_reads_log_spec.rb

diff --git a/spec/features/projects/hook_logs/user_reads_log_spec.rb b/spec/features/projects/hook_logs/user_reads_log_spec.rb
new file mode 100644
index 00000000000..18e975fa653
--- /dev/null
+++ b/spec/features/projects/hook_logs/user_reads_log_spec.rb
@@ -0,0 +1,21 @@
+require 'spec_helper'
+
+feature 'Hook logs' do
+  given(:web_hook_log) { create(:web_hook_log, response_body: '<script>') }
+  given(:project) { web_hook_log.web_hook.project }
+  given(:user) { create(:user) }
+
+  before do
+    project.add_master(user)
+
+    sign_in(user)
+  end
+
+  scenario 'user reads log without getting XSS' do
+    visit(
+      project_hook_hook_log_path(
+        project, web_hook_log.web_hook, web_hook_log))
+
+    expect(page).to have_content('<script>')
+  end
+end
-- 
cgit v1.2.1