Sanitize HTML in folder name

Victor Costa
1 parent 23b9a863
Showing 2 changed files with 9 additions and 1 deletions Show diff stats
app/models/folder.rb
test/unit/folder_test.rb
@@ -12,7 +12,7 @@ class Folder &lt; Article
   acts_as_having_settings :field => :setting
-  xss_terminate :only => [ :body ], :with => 'white_list', :on => 'validation'
+  xss_terminate :only => [ :name, :body ], :with => 'white_list', :on => 'validation'
   include WhiteListFilter
   filter_iframes :body
@@ -100,6 +100,14 @@ class FolderTest &lt; ActiveSupport::TestCase
     assert_includes folder.images(true), community.articles.find_by_name('rails.png')
   end
+  should 'not let pass javascript in the name' do
+    folder = Folder.new
+    folder.name = "<script> alert(Xss!); </script>"
+    folder.valid?
+
+    assert_no_match /(<script>)/, folder.name
+  end
+
   should 'not let pass javascript in the body' do
     folder = Folder.new
     folder.body = "<script> alert(Xss!); </script>"
	@@ -12,7 +12,7 @@ class Folder < Article		@@ -12,7 +12,7 @@ class Folder < Article
12		12
13	acts_as_having_settings :field => :setting	13	acts_as_having_settings :field => :setting
14		14
15	- xss_terminate :only => [ :body ], :with => 'white_list', :on => 'validation'	15	+ xss_terminate :only => [ :name, :body ], :with => 'white_list', :on => 'validation'
16		16
17	include WhiteListFilter	17	include WhiteListFilter
18	filter_iframes :body	18	filter_iframes :body
	@@ -100,6 +100,14 @@ class FolderTest < ActiveSupport::TestCase		@@ -100,6 +100,14 @@ class FolderTest < ActiveSupport::TestCase
100	assert_includes folder.images(true), community.articles.find_by_name('rails.png')	100	assert_includes folder.images(true), community.articles.find_by_name('rails.png')
101	end	101	end
102		102
		103	+ should 'not let pass javascript in the name' do
		104	+ folder = Folder.new
		105	+ folder.name = "<script> alert(Xss!); </script>"
		106	+ folder.valid?
		107	+
		108	+ assert_no_match /(<script>)/, folder.name
		109	+ end
		110	+
103	should 'not let pass javascript in the body' do	111	should 'not let pass javascript in the body' do
104	folder = Folder.new	112	folder = Folder.new
105	folder.body = "<script> alert(Xss!); </script>"	113	folder.body = "<script> alert(Xss!); </script>"