about summary refs log tree commit diff
path: root/spec/lib
diff options
context:
space:
mode:
authornightpool <eg1290@gmail.com>2017-06-17 14:26:05 -0400
committerEugen Rochko <eugen@zeonfederated.com>2017-06-17 20:26:05 +0200
commit94d0e012dea89058b9c059636fb6d42f6565e534 (patch)
treed14c43d4177eefcfa3b981d757753df731e693d8 /spec/lib
parent8fd931dc126d0f90417a6614bd21bb945543e4f4 (diff)
Whitelist allowed classes for federated statuses (#3810)
* Whitelist allowed classes for federated statuses

Allowed classes are currently:

 - Any microformats class (h/p/u/dt/e-*)
 - the classes mention, hashtag, ellipses and invisible.

this last one is somewhat suspect, but Mastodon currently uses it to render hidden link text.

resolved #3790

* Fix code style
Diffstat (limited to 'spec/lib')
-rw-r--r--spec/lib/formatter_spec.rb8
1 files changed, 8 insertions, 0 deletions
diff --git a/spec/lib/formatter_spec.rb b/spec/lib/formatter_spec.rb
index cc32f7fd6..dfe1d8b8f 100644
--- a/spec/lib/formatter_spec.rb
+++ b/spec/lib/formatter_spec.rb
@@ -204,6 +204,14 @@ RSpec.describe Formatter do
         is_expected.to_not include '<script>alert("Hello")</script>'
       end
     end
+
+    context 'contains malicious classes' do
+      let(:text) { '<span class="status__content__spoiler-link">Show more</span>' }
+
+      it 'strips malicious classes' do
+        is_expected.to_not include 'status__content__spoiler-link'
+      end
+    end
   end
 
   describe '#plaintext' do