1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
require 'spec_helper'
describe 'projects/ci/lints/show' do
include Devise::Test::ControllerHelpers
let(:project) { create(:project, :repository) }
let(:config_processor) { Gitlab::Ci::YamlProcessor.new(YAML.dump(content)) }
describe 'XSS protection' do
before do
assign(:project, project)
assign(:status, true)
assign(:builds, config_processor.builds)
assign(:stages, config_processor.stages)
assign(:jobs, config_processor.jobs)
end
context 'when builds attrbiutes contain HTML nodes' do
let(:content) do
{
rspec: {
script: '<h1>rspec</h1>',
stage: 'test'
}
}
end
it 'does not render HTML elements' do
render
expect(rendered).not_to have_css('h1', text: 'rspec')
end
end
context 'when builds attributes do not contain HTML nodes' do
let(:content) do
{
rspec: {
script: 'rspec',
stage: 'test'
}
}
end
it 'shows configuration in the table' do
render
expect(rendered).to have_css('td pre', text: 'rspec')
end
end
end
context 'when the content is valid' do
let(:content) do
{
build_template: {
script: './build.sh',
tags: ['dotnet'],
only: ['test@dude/repo'],
except: ['deploy'],
environment: 'testing'
}
}
end
before do
assign(:project, project)
assign(:status, true)
assign(:builds, config_processor.builds)
assign(:stages, config_processor.stages)
assign(:jobs, config_processor.jobs)
end
it 'shows the correct values' do
render
expect(rendered).to have_content('Tag list: dotnet')
expect(rendered).to have_content('Only policy: refs, test@dude/repo')
expect(rendered).to have_content('Except policy: refs, deploy')
expect(rendered).to have_content('Environment: testing')
expect(rendered).to have_content('When: on_success')
end
end
context 'when the content is invalid' do
before do
assign(:project, project)
assign(:status, false)
assign(:error, 'Undefined error')
end
it 'shows error message' do
render
expect(rendered).to have_content('Status: syntax is incorrect')
expect(rendered).to have_content('Error: Undefined error')
expect(rendered).not_to have_content('Tag list:')
end
end
end
|
