diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js
index 30d92eadd..ca7adf52b 100644
--- a/test/fixtures/expect.js
+++ b/test/fixtures/expect.js
@@ -1001,6 +1001,7 @@ module.exports = [
"
",
"</title><img src=1 onerror=alert(1)>",
"
</title><img src=1 onerror=alert(1)>",
+ "</title><img src=1 onerror=alert(1)>",
""
]
}, {
@@ -1011,6 +1012,7 @@ module.exports = [
"
",
"",
"
",
+ ""
]
}, {
"title": "Tests against mXSS behavior with SVG in Chrome 77 and alike 2/2",
@@ -1019,6 +1021,7 @@ module.exports = [
"",
"<a id=\"
\">",
"",
+ ""
]
}, {
"title": "Tests against mXSS behavior with MathML in Chrome 77 and alike",
@@ -1037,6 +1040,7 @@ module.exports = [
"<template><style>
",
"
",
"",
+ ""
]
}, {
"title": "Tests against mXSS behavior with MathML Templates in Chrome 77 and alike",
@@ -1060,7 +1064,8 @@ module.exports = [
"",
"",
"
",
- "
"
+ "
",
+ ""
]
}, {
"title": "Tests against attribute-based mXSS behavior 1/3",
@@ -1071,6 +1076,7 @@ module.exports = [
"
\">",
"
\">",
"
\">
",
+ "
\">
"
]
}, {
"title": "Tests against attribute-based mXSS behavior 2/3",
diff --git a/test/test-suite.js b/test/test-suite.js
index 4d5c8c277..7b1c52f28 100644
--- a/test/test-suite.js
+++ b/test/test-suite.js
@@ -799,7 +799,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
var dirty =
'';
DOMPurify.sanitize(dirty);
- assert.equal(DOMPurify.removed.length, 1);
+ assert.contains(DOMPurify.removed.length, [1, 2]); // IE removes two
});
// Test 2 to check if the element count in DOMPurify.removed is correct
@@ -809,7 +809,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
var dirty =
'1';
DOMPurify.sanitize(dirty);
- assert.equal(DOMPurify.removed.length, 2);
+ assert.contains(DOMPurify.removed.length, [2, 3]); // IE removed three
});
// Test 3 to check if the element count in DOMPurify.removed is correct
@@ -1070,27 +1070,27 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
DOMPurify.sanitize('HELLO
', {
USE_PROFILES: { html: true, mathMl: true },
}),
- ['HELLO
', 'HELLO
']
+ ['HELLO
', 'HELLO
', "HELLO
"]
);
assert.contains(
DOMPurify.sanitize('HELLO
', {
USE_PROFILES: { html: true, mathMl: true },
}),
- ['HELLO
', 'HELLO
']
+ ['HELLO
', 'HELLO
', "HELLO
"]
);
assert.contains(
DOMPurify.sanitize('HELLO
', {
USE_PROFILES: { html: true, mathMl: true },
FORBID_TAGS: ['mi'],
}),
- ['HELLO
', 'HELLO
']
+ ['HELLO
', 'HELLO
', "HELLO
"]
);
assert.contains(
DOMPurify.sanitize('HELLO
', {
USE_PROFILES: { html: true, mathMl: true },
FORBID_ATTR: ['class'],
}),
- ['HELLO
', 'HELLO
']
+ ['HELLO
', 'HELLO
', "HELLO
"]
);
assert.equal(
DOMPurify.sanitize('HELLO
', { USE_PROFILES: { bogus: true } }),
@@ -1112,6 +1112,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
'',
'',
'',
+ ""
]
);
assert.contains(
@@ -1124,6 +1125,8 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
'',
'',
'',
+ "",
+ ""
]
);
assert.contains(
@@ -1134,6 +1137,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
'',
'',
'',
+ ""
]
);
assert.contains(
@@ -1145,6 +1149,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
'',
'',
'',
+ ""
]
);
assert.equal(
@@ -1231,7 +1236,9 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
'',
'',
"",
- ""
+ "",
+ "",
+ ""
]);
});
QUnit.test('Avoid mXSS in Chrome 77 and above using HTML', function (assert) {
@@ -1243,6 +1250,8 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
'<a href="qqq',
"qqq",
"",
+ "",
+ ""
]);
});
QUnit.test(
@@ -1459,36 +1468,47 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
var tests = [
{
test: '',
- expected: '',
+ expected: [
+ '',
+ "",
+ ""
+ ]
},
{
test: '',
- expected: '',
+ expected: [
+ '',
+ ""
+ ]
},
{
test: '',
- expected: ''
+ expected: ['']
},
{
test: '',
- expected: ''
+ expected: ['', ""]
},
{
test: '',
- expected: ''
+ expected: ['', ""]
},
{
test: '',
- expected: ''
+ expected: [
+ '',
+ "",
+ ""
+ ]
},
{
test: ''
+ expected: ['', ""]
},
];
tests.forEach(function (test) {
var clean = DOMPurify.sanitize(test.test);
- assert.equal(clean, test.expected)
+ assert.contains(clean, test.expected)
});
}
);