Test escaping

ankane · Jul 10, 2020 · d3bc937 · d3bc937
1 parent 57551ee
commit d3bc937
Showing 1 changed file with 19 additions and 3 deletions.
diff --git a/test/chartkick_test.rb b/test/chartkick_test.rb
@@ -73,25 +73,41 @@ def test_chartkick_deep_merge_same_inner_key
   end
 
   def test_id
-    assert_match "id=\"test-123\"", line_chart(@data, id: "test-123")
+    assert_match "id=\"test-id\"", line_chart(@data, id: "test-id")
+  end
+
+  def test_id_escaped
+    assert_match "id=\"test-123&quot;\"", line_chart(@data, id: "test-123\"")
   end
 
   def test_height
     assert_match "height: 150px;", line_chart(@data, height: "150px")
   end
 
+  def test_height_escaped
+    assert_match "height: 150px&quot;;", line_chart(@data, height: "150px\"")
+  end
+
   def test_width
     assert_match "width: 80%;", line_chart(@data, width: "80%")
   end
 
-  def test_defer
-    assert_match "window.addEventListener", line_chart(@data, defer: true)
+  def test_width_escaped
+    assert_match "width: 80%&quot;;", line_chart(@data, width: "80%\"")
   end
 
   def test_nonce
     assert_match "nonce=\"test-123\"", line_chart(@data, nonce: "test-123")
   end
 
+  def test_nonce_escaped
+    assert_match "nonce=\"test-123&quot;\"", line_chart(@data, nonce: "test-123\"")
+  end
+
+  def test_defer
+    assert_match "window.addEventListener", line_chart(@data, defer: true)
+  end
+
   def test_content_for
     refute_match "<script", line_chart(@data, content_for: :charts_js)
     assert_match "<script", @content_for[:charts_js]