diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js index 30d92eadd..ca7adf52b 100644 --- a/test/fixtures/expect.js +++ b/test/fixtures/expect.js @@ -1001,6 +1001,7 @@ module.exports = [ "", "&lt;/title&gt;&lt;img src=1 onerror=alert(1)>", "&lt;/title&gt;&lt;img src=1 onerror=alert(1)>", + "</title><img src=1 onerror=alert(1)>", "" ] }, { @@ -1011,6 +1012,7 @@ module.exports = [ "

", "", "

", + "" ] }, { "title": "Tests against mXSS behavior with SVG in Chrome 77 and alike 2/2", @@ -1019,6 +1021,7 @@ module.exports = [ "", "

<a id=\"\">", "\">", + "\">" ] }, { "title": "Tests against mXSS behavior with MathML in Chrome 77 and alike", @@ -1037,6 +1040,7 @@ module.exports = [ "

<template><style>", "

", "", + "" ] }, { "title": "Tests against mXSS behavior with MathML Templates in Chrome 77 and alike", @@ -1060,7 +1064,8 @@ module.exports = [ "", "", "

", - "

" + "

", + "" ] }, { "title": "Tests against attribute-based mXSS behavior 1/3", @@ -1071,6 +1076,7 @@ module.exports = [ "

\">", "

\">", "

\">

", + "

\">

" ] }, { "title": "Tests against attribute-based mXSS behavior 2/3", diff --git a/test/test-suite.js b/test/test-suite.js index 4d5c8c277..7b1c52f28 100644 --- a/test/test-suite.js +++ b/test/test-suite.js @@ -799,7 +799,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) { var dirty = ''; DOMPurify.sanitize(dirty); - assert.equal(DOMPurify.removed.length, 1); + assert.contains(DOMPurify.removed.length, [1, 2]); // IE removes two }); // Test 2 to check if the element count in DOMPurify.removed is correct @@ -809,7 +809,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) { var dirty = '1'; DOMPurify.sanitize(dirty); - assert.equal(DOMPurify.removed.length, 2); + assert.contains(DOMPurify.removed.length, [2, 3]); // IE removed three }); // Test 3 to check if the element count in DOMPurify.removed is correct @@ -1070,27 +1070,27 @@ module.exports = function (DOMPurify, window, tests, xssTests) { DOMPurify.sanitize('

HELLO

', { USE_PROFILES: { html: true, mathMl: true }, }), - ['

HELLO

', '

HELLO

'] + ['

HELLO

', '

HELLO

', "

HELLO

"] ); assert.contains( DOMPurify.sanitize('

HELLO

', { USE_PROFILES: { html: true, mathMl: true }, }), - ['

HELLO

', '

HELLO

'] + ['

HELLO

', '

HELLO

', "

HELLO

"] ); assert.contains( DOMPurify.sanitize('

HELLO

', { USE_PROFILES: { html: true, mathMl: true }, FORBID_TAGS: ['mi'], }), - ['

HELLO

', '

HELLO

'] + ['

HELLO

', '

HELLO

', "

HELLO

"] ); assert.contains( DOMPurify.sanitize('

HELLO

', { USE_PROFILES: { html: true, mathMl: true }, FORBID_ATTR: ['class'], }), - ['

HELLO

', '

HELLO

'] + ['

HELLO

', '

HELLO

', "

HELLO

"] ); assert.equal( DOMPurify.sanitize('

HELLO

', { USE_PROFILES: { bogus: true } }), @@ -1112,6 +1112,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) { '', '', '', + "" ] ); assert.contains( @@ -1124,6 +1125,8 @@ module.exports = function (DOMPurify, window, tests, xssTests) { '', '', '', + "", + "" ] ); assert.contains( @@ -1134,6 +1137,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) { '', '', '', + "" ] ); assert.contains( @@ -1145,6 +1149,7 @@ module.exports = function (DOMPurify, window, tests, xssTests) { '', 'SEE ME', 'SEE ME', + "" ] ); assert.equal( @@ -1231,7 +1236,9 @@ module.exports = function (DOMPurify, window, tests, xssTests) { '

', '

', "

", - "" + "", + "", + "" ]); }); QUnit.test('Avoid mXSS in Chrome 77 and above using HTML', function (assert) { @@ -1243,6 +1250,8 @@ module.exports = function (DOMPurify, window, tests, xssTests) { '

<a href="qqq', "

qqq", "", + "", + "" ]); }); QUnit.test( @@ -1459,36 +1468,47 @@ module.exports = function (DOMPurify, window, tests, xssTests) { var tests = [ { test: '', - expected: '', + expected: [ + '', + "", + "" + ] }, { test: '', - expected: '', + expected: [ + '', + "" + ] }, { test: '', - expected: '' + expected: [''] }, { test: '', - expected: '' + expected: ['', ""] }, { test: '', - expected: '' + expected: ['', ""] }, { test: '', - expected: '' + expected: [ + '', + "", + "" + ] }, { test: '
', - expected: '
' + expected: ['
', "
"] }, ]; tests.forEach(function (test) { var clean = DOMPurify.sanitize(test.test); - assert.equal(clean, test.expected) + assert.contains(clean, test.expected) }); } );