Upstream filp/whoops state of the touched files before 4a1b06f129
This commit is contained in:
1 parent
1e51c75014
commit
24517bcbde
2 files changed
+1
-42
No files matched your search
@@ -63,44 +63,6 @@ class TemplateHelperTest extends TestCase
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
|
||||
*/
|
||||
public function testEscapeButPreserveUrisRejectsDangerousSchemes()
|
||||
{
|
||||
$dangerous = [
|
||||
'javascript://x.co/?%0Aalert(1)',
|
||||
'vbscript://x.co/?%0Amsgbox(1)',
|
||||
'data://text/html,<script>alert(1)</script>',
|
||||
];
|
||||
|
||||
foreach ($dangerous as $payload) {
|
||||
$output = $this->helper->escapeButPreserveUris($payload);
|
||||
|
||||
$this->assertStringNotContainsString(
|
||||
'<a href=',
|
||||
$output,
|
||||
"Payload '$payload' must not be turned into a clickable link"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
|
||||
*/
|
||||
public function testEscapeButPreserveUrisAllowsHttpAndHttpsSchemes()
|
||||
{
|
||||
$this->assertEquals(
|
||||
"<a href=\"http://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">http://google.com</a>",
|
||||
$this->helper->escapeButPreserveUris('http://google.com')
|
||||
);
|
||||
|
||||
$this->assertEquals(
|
||||
"<a href=\"https://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">https://google.com</a>",
|
||||
$this->helper->escapeButPreserveUris('https://google.com')
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @covers Whoops\Util\TemplateHelper::breakOnDelimiter
|
||||
*/
|
||||
|
||||
Reference in new issue
Block a user