avoid html double escape

This is already handled on rails 3. Fix #62

avoid html double escape
This is already handled on rails 3. Fix #62
Rodrigo Souto
1 parent 89b2559c
Showing 13 changed files with 16 additions and 209 deletions Show diff stats
test/unit/article_test.rb
test/unit/comment_test.rb
test/unit/community_test.rb
test/unit/environment_test.rb
test/unit/event_test.rb
test/unit/folder_test.rb
test/unit/gallery_test.rb
test/unit/organization_test.rb
test/unit/product_test.rb
test/unit/profile_test.rb
test/unit/text_article_test.rb
test/unit/validation_info_test.rb
vendor/plugins/xss_terminate/lib/xss_terminate.rb
@@ -931,14 +931,6 @@ class ArticleTest &lt; ActiveSupport::TestCase
     assert_no_match(/<script>/, a.name)
   end
-  should 'escape malformed html tags' do
-    article = Article.new
-    article.name = "<h1 Malformed >> html >< tag"
-    article.valid?
-
-    assert_no_match /[<>]/, article.name
-  end
-
   should 'return truncated title in short_title' do
     article = Article.new
     article.name = 'a123456789abcdefghij'
@@ -201,17 +201,6 @@ class CommentTest &lt; ActiveSupport::TestCase
     assert comment.errors[:body.to_s].present?
   end
-  should 'escape malformed html tags' do
-    owner = create_user('testuser').person
-    article = owner.articles.create(:name => 'test', :body => '...')
-    comment = build(Comment, :article => article, :title => '<h1 title </h1>>> sd f <<', :body => '<h1>> sdf><asd>< body </h1>', :name => '<h1 name </h1>>><<dfsf<sd', :email => 'cracker@test.org')
-    comment.valid?
-
-    assert_no_match /[<>]/, comment.title
-    assert_no_match /[<>]/, comment.body
-    assert_no_match /[<>]/, comment.name
-  end
-
   should 'use an existing image for deleted comments' do
     image = Comment.new.removed_user_image[1..-1]
     assert File.exists?(Rails.root.join('public', image)), "#{image} does not exist."
@@ -749,6 +738,18 @@ class CommentTest &lt; ActiveSupport::TestCase
     comment.destroy
   end
+  should 'not double escape html content after validation' do
+    comment = create_comment
+    body = 'Comment with "quotes"'
+    comment.body = body
+
+    comment.valid?
+    assert_equal body, comment.body
+
+    comment.valid?
+    assert_equal body, comment.body
+  end
+
   private
   def create_comment(args = {})
@@ -242,20 +242,6 @@ class CommunityTest &lt; ActiveSupport::TestCase
     end
   end
-  should 'escape malformed html tags' do
-    community = Community.new
-    community.name = "<h1 Malformed >> html >< tag"
-    community.address = "<h1 Malformed >,<<<asfdf> html >< tag"
-    community.contact_phone = "<h1 Malformed<<> >> html >><>< tag"
-    community.description = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    community.valid?
-
-    assert_no_match /[<>]/, community.name
-    assert_no_match /[<>]/, community.address
-    assert_no_match /[<>]/, community.contact_phone
-    assert_no_match /[<>]/, community.description
-  end
-
   should "the followed_by method be protected and true to the community members by default" do
     c = fast_create(Community)
     p1 = fast_create(Person)
@@ -1140,14 +1140,6 @@ class EnvironmentTest &lt; ActiveSupport::TestCase
     assert_equal "<h1> Disabled Enterprise </h1>", environment.message_for_disabled_enterprise
   end
-  should 'escape malformed html tags' do
-    environment = Environment.new
-    environment.message_for_disabled_enterprise = "<h1> Disabled Enterprise /h1>"
-    environment.valid?
-
-    assert_no_match /[<>]/, environment.message_for_disabled_enterprise
-  end
-
   should 'not sanitize html comments' do
     environment = Environment.new
     environment.message_for_disabled_enterprise = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'
@@ -263,24 +263,6 @@ class EventTest &lt; ActiveSupport::TestCase
     assert_not_includes profile.events.by_day(today), event_out_of_range
   end
-  should 'filter fields with full filter' do
-    event = Event.new
-    event.link = "<h1 Malformed >> html >< tag"
-    event.valid?
-
-    assert_no_match /[<>]/, event.link
-  end
-
-  should 'filter fields with white_list filter' do
-    event = Event.new
-    event.body = "<h1> Description </h1>"
-    event.address = "<strong> Address <strong>"
-    event.valid?
-
-    assert_equal "<h1> Description </h1>", event.body
-    assert_equal "<strong> Address <strong>", event.address
-  end
-
   should 'not filter & on link field' do
     event = Event.new
     event.link = 'myevent.com/?param1=value&param2=value2'
@@ -289,16 +271,6 @@ class EventTest &lt; ActiveSupport::TestCase
     assert_equal "http://myevent.com/?param1=value&param2=value2", event.link
   end
-  should 'escape malformed html tags' do
-    event = Event.new
-    event.body = "<h1<< Description >>/h1>"
-    event.address = "<strong>><< Address <strong>"
-    event.valid?
-
-    assert_no_match /[<>]/, event.body
-    assert_no_match /[<>]/, event.address
-  end
-
   should 'not sanitize html comments' do
     event = Event.new
     event.body = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'
@@ -133,14 +133,6 @@ class FolderTest &lt; ActiveSupport::TestCase
     assert_match  /<!-- .* --> <h1> Wellformed html code <\/h1>/, folder.body
   end
-  should 'escape malformed html tags' do
-    folder = Folder.new
-    folder.body = "<h1<< Description >>/h1>"
-    folder.valid?
-
-    assert_no_match /[<>]/, folder.body
-  end
-
   should 'not have a blog as parent' do
     folder = Folder.new
     folder.parent = Blog.new
@@ -134,14 +134,6 @@ class GalleryTest &lt; ActiveSupport::TestCase
     assert_match  /<!-- .* --> <h1> Wellformed html code <\/h1>/, gallery.body
   end
-  should 'escape malformed html tags' do
-    gallery = Gallery.new
-    gallery.body = "<h1<< Description >>/h1>"
-    gallery.valid?
-
-    assert_no_match /[<>]/, gallery.body
-  end
-
   should 'accept uploads' do
     folder = fast_create(Gallery)
     assert folder.accept_uploads?
@@ -253,25 +253,6 @@ class OrganizationTest &lt; ActiveSupport::TestCase
     assert organization.closed
   end
-  should 'escape malformed html tags' do
-    organization = Organization.new
-    organization.acronym = "<h1 Malformed >> html >< tag"
-    organization.contact_person = "<h1 Malformed >,<<<asfdf> html >< tag"
-    organization.contact_email = "<h1<malformed@html.com>>"
-    organization.description = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.legal_form = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.economic_activity = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.management_information = "<h1 Malformed /h1>>><<> html ><>h1< tag"
-    organization.valid?
-
-    assert_no_match /[<>]/, organization.acronym
-    assert_no_match /[<>]/, organization.contact_person
-    assert_no_match /[<>]/, organization.contact_email
-    assert_no_match /[<>]/, organization.legal_form
-    assert_no_match /[<>]/, organization.economic_activity
-    assert_no_match /[<>]/, organization.management_information
-  end
-
   should "the followed_by? be true only to members" do
     o = fast_create(Organization)
     p1 = fast_create(Person)
@@ -171,16 +171,6 @@ class ProductTest &lt; ActiveSupport::TestCase
     assert_equal @product_category.name, product.name
   end
-  should 'escape malformed html tags' do
-    product = build(Product, :product_category => @product_category)
-    product.name = "<h1 Malformed >> html >< tag"
-    product.description = "<h1 Malformed</h1>><<<a>> >> html >< tag"
-    product.valid?
-
-    assert_no_match /[<>]/, product.name
-    assert_no_match /[<>]/, product.description
-  end
-
   should 'use name of category when has no name yet' do
     product = Product.new
     product.product_category = @product_category
@@ -1696,34 +1696,6 @@ class ProfileTest &lt; ActiveSupport::TestCase
     assert_equal "<strong> Custom Footer <strong>", profile.custom_footer
   end
-  should 'escape malformed html tags' do
-    profile = Profile.new
-    profile.name = "<h1 Malformed >> html >>></a>< tag"
-    profile.nickname = "<h1 Malformed <<h1>>< html >< tag"
-    profile.address = "<h1><</h2< Malformed >> html >< tag"
-    profile.contact_phone = "<h1<< Malformed ><>>> html >< tag"
-    profile.description = "<h1<a> Malformed >> html ></a>< tag"
-    profile.valid?
-
-    assert_no_match /[<>]/, profile.name
-    assert_no_match /[<>]/, profile.nickname
-    assert_no_match /[<>]/, profile.address
-    assert_no_match /[<>]/, profile.contact_phone
-    assert_no_match /[<>]/, profile.description
-    assert_no_match /[<>]/, profile.custom_header
-    assert_no_match /[<>]/, profile.custom_footer
-  end
-
-  should 'escape malformed html tags in header and footer' do
-    profile = fast_create(Profile)
-    profile.custom_header = "<h1<a>><<> Malformed >> html ></a>< tag"
-    profile.custom_footer = "<h1> Malformed <><< html ></a>< tag"
-    profile.save
-
-    assert_no_match /[<>]/, profile.custom_header
-    assert_no_match /[<>]/, profile.custom_footer
-  end
-
   should 'not sanitize html comments' do
     profile = Profile.new
     profile.custom_header = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'
@@ -14,15 +14,6 @@ class TextArticleTest &lt; ActiveSupport::TestCase
     assert_includes TextArticle.find(:all), article
   end
-  should 'remove HTML from name' do
-    person = create_user('testuser').person
-    article = TextArticle.new(:profile => person)
-    article.name = "<h1 Malformed >> html >>></a>< tag"
-    article.valid?
-
-    assert_no_match /[<>]/, article.name
-  end
-
   should 'be translatable' do
     assert_kind_of Noosfero::TranslatableContent, TextArticle.new
   end
@@ -21,14 +21,4 @@ class ValidationInfoTest &lt; ActiveSupport::TestCase
     end
   end
-  should 'escape malformed html tags' do
-    info = ValidationInfo.new
-    info.validation_methodology = "<h1 Malformed >> html >< tag"
-    info.restrictions = "<h1 Malformed >> html >< tag"
-    info.valid?
-
-    assert_no_match /[<>]/, info.validation_methodology
-    assert_no_match /[<>]/, info.restrictions
-  end
-
 end
@@ -38,7 +38,7 @@ module XssTerminate
   module InstanceMethods
-    def sanitize_field(sanitizer, field, serialized = false, with= :full)
+    def sanitize_field(sanitizer, field, serialized = false)
       field = field.to_sym
       if serialized
         puts field
@@ -49,25 +49,11 @@ module XssTerminate
       else
         if self[field]
           self[field] = sanitizer.sanitize(self[field])
-
-          if with == :full
-            self[field] = CGI.escapeHTML(self[field])
-          elsif with == :white_list
-            self[field] = CGI.escapeHTML(self[field]) if !wellformed_html_code?(self[field])
-          end
-
         else
           value = self.send("#{field}")
           return unless value
           value = sanitizer.sanitize(value)
           self.send("#{field}=", value)
-
-          if with == :full
-            self.send("#{field}=", CGI.escapeHTML(value))
-          elsif with == :white_list
-            self.send("#{field}=", CGI.escapeHTML(value)) if !wellformed_html_code?(value)
-          end
-
         end
       end
     end
@@ -86,7 +72,7 @@ module XssTerminate
       sanitizer = ActionView::Base.full_sanitizer
       columns, columns_serialized = sanitize_columns(:full)
       columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column), :full)
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
     end
@@ -94,7 +80,7 @@ module XssTerminate
       sanitizer = ActionView::Base.white_list_sanitizer
       columns, columns_serialized = sanitize_columns(:white_list)
       columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column), :white_list)
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
    end
@@ -102,38 +88,8 @@ module XssTerminate
       sanitizer = HTML5libSanitize.new
       columns = sanitize_columns(:html5lib)
       columns.each do |column|
-        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column), :html5lib)
-      end
-    end
-
-    def wellformed_html_code?(field)
-      return true if !field
-      counter = 0
-      in_comment = false
-      field=field.split(//)
-      for i in 0..field.length-1
-        if !in_comment
-          if field[i] == '<'
-            if field[i+1..i+3] == ["!","-","-"]
-              in_comment = true
-            else
-              counter += 1
-            end
-          elsif field[i] == '>'
-            counter -= 1
-          end
-        else
-          if field[i-2..i] == ["-","-",">"]
-            in_comment = false
-          end
-        end
-
-        if counter < 0 || 1 < counter
-          return false
-        end
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
-
-      return counter == 0
     end
   end
	@@ -931,14 +931,6 @@ class ArticleTest < ActiveSupport::TestCase		@@ -931,14 +931,6 @@ class ArticleTest < ActiveSupport::TestCase
931	assert_no_match(/<script>/, a.name)	931	assert_no_match(/<script>/, a.name)
932	end	932	end
933		933
934	- should 'escape malformed html tags' do
935	- article = Article.new
936	- article.name = "<h1 Malformed >> html >< tag"
937	- article.valid?
938	-
939	- assert_no_match /[<>]/, article.name
940	- end
941	-
942	should 'return truncated title in short_title' do	934	should 'return truncated title in short_title' do
943	article = Article.new	935	article = Article.new
944	article.name = 'a123456789abcdefghij'	936	article.name = 'a123456789abcdefghij'
	@@ -242,20 +242,6 @@ class CommunityTest < ActiveSupport::TestCase		@@ -242,20 +242,6 @@ class CommunityTest < ActiveSupport::TestCase
242	end	242	end
243	end	243	end
244		244
245	- should 'escape malformed html tags' do
246	- community = Community.new
247	- community.name = "<h1 Malformed >> html >< tag"
248	- community.address = "<h1 Malformed >,<<<asfdf> html >< tag"
249	- community.contact_phone = "<h1 Malformed<<> >> html >><>< tag"
250	- community.description = "<h1 Malformed /h1>>><<> html ><>h1< tag"
251	- community.valid?
252	-
253	- assert_no_match /[<>]/, community.name
254	- assert_no_match /[<>]/, community.address
255	- assert_no_match /[<>]/, community.contact_phone
256	- assert_no_match /[<>]/, community.description
257	- end
258	-
259	should "the followed_by method be protected and true to the community members by default" do	245	should "the followed_by method be protected and true to the community members by default" do
260	c = fast_create(Community)	246	c = fast_create(Community)
261	p1 = fast_create(Person)	247	p1 = fast_create(Person)
	@@ -1140,14 +1140,6 @@ class EnvironmentTest < ActiveSupport::TestCase		@@ -1140,14 +1140,6 @@ class EnvironmentTest < ActiveSupport::TestCase
1140	assert_equal "<h1> Disabled Enterprise </h1>", environment.message_for_disabled_enterprise	1140	assert_equal "<h1> Disabled Enterprise </h1>", environment.message_for_disabled_enterprise
1141	end	1141	end
1142		1142
1143	- should 'escape malformed html tags' do
1144	- environment = Environment.new
1145	- environment.message_for_disabled_enterprise = "<h1> Disabled Enterprise /h1>"
1146	- environment.valid?
1147	-
1148	- assert_no_match /[<>]/, environment.message_for_disabled_enterprise
1149	- end
1150	-
1151	should 'not sanitize html comments' do	1143	should 'not sanitize html comments' do
1152	environment = Environment.new	1144	environment = Environment.new
1153	environment.message_for_disabled_enterprise = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'	1145	environment.message_for_disabled_enterprise = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'
	@@ -263,24 +263,6 @@ class EventTest < ActiveSupport::TestCase		@@ -263,24 +263,6 @@ class EventTest < ActiveSupport::TestCase
263	assert_not_includes profile.events.by_day(today), event_out_of_range	263	assert_not_includes profile.events.by_day(today), event_out_of_range
264	end	264	end
265		265
266	- should 'filter fields with full filter' do
267	- event = Event.new
268	- event.link = "<h1 Malformed >> html >< tag"
269	- event.valid?
270	-
271	- assert_no_match /[<>]/, event.link
272	- end
273	-
274	- should 'filter fields with white_list filter' do
275	- event = Event.new
276	- event.body = "<h1> Description </h1>"
277	- event.address = "<strong> Address <strong>"
278	- event.valid?
279	-
280	- assert_equal "<h1> Description </h1>", event.body
281	- assert_equal "<strong> Address <strong>", event.address
282	- end
283	-
284	should 'not filter & on link field' do	266	should 'not filter & on link field' do
285	event = Event.new	267	event = Event.new
286	event.link = 'myevent.com/?param1=value&param2=value2'	268	event.link = 'myevent.com/?param1=value&param2=value2'
	@@ -289,16 +271,6 @@ class EventTest < ActiveSupport::TestCase		@@ -289,16 +271,6 @@ class EventTest < ActiveSupport::TestCase
289	assert_equal "http://myevent.com/?param1=value&param2=value2", event.link	271	assert_equal "http://myevent.com/?param1=value&param2=value2", event.link
290	end	272	end
291		273
292	- should 'escape malformed html tags' do
293	- event = Event.new
294	- event.body = "<h1<< Description >>/h1>"
295	- event.address = "<strong>><< Address <strong>"
296	- event.valid?
297	-
298	- assert_no_match /[<>]/, event.body
299	- assert_no_match /[<>]/, event.address
300	- end
301	-
302	should 'not sanitize html comments' do	274	should 'not sanitize html comments' do
303	event = Event.new	275	event = Event.new
304	event.body = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'	276	event.body = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'
	@@ -133,14 +133,6 @@ class FolderTest < ActiveSupport::TestCase		@@ -133,14 +133,6 @@ class FolderTest < ActiveSupport::TestCase
133	assert_match /<!-- .* --> <h1> Wellformed html code <\/h1>/, folder.body	133	assert_match /<!-- .* --> <h1> Wellformed html code <\/h1>/, folder.body
134	end	134	end
135		135
136	- should 'escape malformed html tags' do
137	- folder = Folder.new
138	- folder.body = "<h1<< Description >>/h1>"
139	- folder.valid?
140	-
141	- assert_no_match /[<>]/, folder.body
142	- end
143	-
144	should 'not have a blog as parent' do	136	should 'not have a blog as parent' do
145	folder = Folder.new	137	folder = Folder.new
146	folder.parent = Blog.new	138	folder.parent = Blog.new
	@@ -134,14 +134,6 @@ class GalleryTest < ActiveSupport::TestCase		@@ -134,14 +134,6 @@ class GalleryTest < ActiveSupport::TestCase
134	assert_match /<!-- .* --> <h1> Wellformed html code <\/h1>/, gallery.body	134	assert_match /<!-- .* --> <h1> Wellformed html code <\/h1>/, gallery.body
135	end	135	end
136		136
137	- should 'escape malformed html tags' do
138	- gallery = Gallery.new
139	- gallery.body = "<h1<< Description >>/h1>"
140	- gallery.valid?
141	-
142	- assert_no_match /[<>]/, gallery.body
143	- end
144	-
145	should 'accept uploads' do	137	should 'accept uploads' do
146	folder = fast_create(Gallery)	138	folder = fast_create(Gallery)
147	assert folder.accept_uploads?	139	assert folder.accept_uploads?
	@@ -253,25 +253,6 @@ class OrganizationTest < ActiveSupport::TestCase		@@ -253,25 +253,6 @@ class OrganizationTest < ActiveSupport::TestCase
253	assert organization.closed	253	assert organization.closed
254	end	254	end
255		255
256	- should 'escape malformed html tags' do
257	- organization = Organization.new
258	- organization.acronym = "<h1 Malformed >> html >< tag"
259	- organization.contact_person = "<h1 Malformed >,<<<asfdf> html >< tag"
260	- organization.contact_email = "<h1<malformed@html.com>>"
261	- organization.description = "<h1 Malformed /h1>>><<> html ><>h1< tag"
262	- organization.legal_form = "<h1 Malformed /h1>>><<> html ><>h1< tag"
263	- organization.economic_activity = "<h1 Malformed /h1>>><<> html ><>h1< tag"
264	- organization.management_information = "<h1 Malformed /h1>>><<> html ><>h1< tag"
265	- organization.valid?
266	-
267	- assert_no_match /[<>]/, organization.acronym
268	- assert_no_match /[<>]/, organization.contact_person
269	- assert_no_match /[<>]/, organization.contact_email
270	- assert_no_match /[<>]/, organization.legal_form
271	- assert_no_match /[<>]/, organization.economic_activity
272	- assert_no_match /[<>]/, organization.management_information
273	- end
274	-
275	should "the followed_by? be true only to members" do	256	should "the followed_by? be true only to members" do
276	o = fast_create(Organization)	257	o = fast_create(Organization)
277	p1 = fast_create(Person)	258	p1 = fast_create(Person)
	@@ -171,16 +171,6 @@ class ProductTest < ActiveSupport::TestCase		@@ -171,16 +171,6 @@ class ProductTest < ActiveSupport::TestCase
171	assert_equal @product_category.name, product.name	171	assert_equal @product_category.name, product.name
172	end	172	end
173		173
174	- should 'escape malformed html tags' do
175	- product = build(Product, :product_category => @product_category)
176	- product.name = "<h1 Malformed >> html >< tag"
177	- product.description = "<h1 Malformed</h1>><<<a>> >> html >< tag"
178	- product.valid?
179	-
180	- assert_no_match /[<>]/, product.name
181	- assert_no_match /[<>]/, product.description
182	- end
183	-
184	should 'use name of category when has no name yet' do	174	should 'use name of category when has no name yet' do
185	product = Product.new	175	product = Product.new
186	product.product_category = @product_category	176	product.product_category = @product_category
	@@ -1696,34 +1696,6 @@ class ProfileTest < ActiveSupport::TestCase		@@ -1696,34 +1696,6 @@ class ProfileTest < ActiveSupport::TestCase
1696	assert_equal "<strong> Custom Footer <strong>", profile.custom_footer	1696	assert_equal "<strong> Custom Footer <strong>", profile.custom_footer
1697	end	1697	end
1698		1698
1699	- should 'escape malformed html tags' do
1700	- profile = Profile.new
1701	- profile.name = "<h1 Malformed >> html >>></a>< tag"
1702	- profile.nickname = "<h1 Malformed <<h1>>< html >< tag"
1703	- profile.address = "<h1><</h2< Malformed >> html >< tag"
1704	- profile.contact_phone = "<h1<< Malformed ><>>> html >< tag"
1705	- profile.description = "<h1<a> Malformed >> html ></a>< tag"
1706	- profile.valid?
1707	-
1708	- assert_no_match /[<>]/, profile.name
1709	- assert_no_match /[<>]/, profile.nickname
1710	- assert_no_match /[<>]/, profile.address
1711	- assert_no_match /[<>]/, profile.contact_phone
1712	- assert_no_match /[<>]/, profile.description
1713	- assert_no_match /[<>]/, profile.custom_header
1714	- assert_no_match /[<>]/, profile.custom_footer
1715	- end
1716	-
1717	- should 'escape malformed html tags in header and footer' do
1718	- profile = fast_create(Profile)
1719	- profile.custom_header = "<h1<a>><<> Malformed >> html ></a>< tag"
1720	- profile.custom_footer = "<h1> Malformed <><< html ></a>< tag"
1721	- profile.save
1722	-
1723	- assert_no_match /[<>]/, profile.custom_header
1724	- assert_no_match /[<>]/, profile.custom_footer
1725	- end
1726	-
1727	should 'not sanitize html comments' do	1699	should 'not sanitize html comments' do
1728	profile = Profile.new	1700	profile = Profile.new
1729	profile.custom_header = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'	1701	profile.custom_header = '<p><!-- <asdf> << aasdfa >>> --> <h1> Wellformed html code </h1>'
	@@ -14,15 +14,6 @@ class TextArticleTest < ActiveSupport::TestCase		@@ -14,15 +14,6 @@ class TextArticleTest < ActiveSupport::TestCase
14	assert_includes TextArticle.find(:all), article	14	assert_includes TextArticle.find(:all), article
15	end	15	end
16		16
17	- should 'remove HTML from name' do
18	- person = create_user('testuser').person
19	- article = TextArticle.new(:profile => person)
20	- article.name = "<h1 Malformed >> html >>></a>< tag"
21	- article.valid?
22	-
23	- assert_no_match /[<>]/, article.name
24	- end
25	-
26	should 'be translatable' do	17	should 'be translatable' do
27	assert_kind_of Noosfero::TranslatableContent, TextArticle.new	18	assert_kind_of Noosfero::TranslatableContent, TextArticle.new
28	end	19	end