library-mirrors/jquery
1
0
Fork 0
mirror of https://github.com/jquery/jquery.git synced 2025-01-10 18:24:24 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Tests: Workaround failures in recent XSS tests in iOS 8 - 12

Browse Source 
iOS 8-12 parses `<noembed>` tags differently, executing this code. This is no
different to native behavior on that OS, though, so just accept it.

Ref gh-4685
Closes gh-4694
This commit is contained in:
Michał Gołębiowski-Owczarek 2020-04-30 21:25:29 +02:00 committed by GitHub
parent 1a7332ce83
commit 11066a9e6a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
test/unit/manipulation.js
View File

@ -2917,7 +2917,8 @@ QUnit.test( "Sanitized HTML doesn't get unsanitized", function( assert ) {
var container,
counter = 0,
assertCount = 13,
oldIos = /iphone os (?:8|9|10|11|12)_/i.test( navigator.userAgent ),
assertCount = oldIos ? 12 : 13,
done = assert.async( assertCount );
assert.expect( assertCount );
@ -2954,10 +2955,17 @@ QUnit.test( "Sanitized HTML doesn't get unsanitized", function( assert ) {
test( "<title><title /><img src=url404 onerror=xss(4)>" );
test( "<iframe><iframe/><img src=url404 onerror=xss(5)>" );
test( "<noframes><noframes/><img src=url404 onerror=xss(6)>" );
test( "<noembed><noembed/><img src=url404 onerror=xss(7)>" );
test( "<noscript><noscript/><img src=url404 onerror=xss(8)>" );
test( "<foo\" alt=\"\" title=\"/><img src=url404 onerror=xss(9)>\">" );
test( "<img alt=\"<x\" title=\"\" src=\"/><img src=url404 onerror=xss(10)>\">" );
test( "<noscript/><img src=url404 onerror=xss(11)>" );
test( "<option><style></option></select><img src=url404 onerror=xss(12)></style>" );
test( "<noscript><noscript/><img src=url404 onerror=xss(7)>" );
test( "<foo\" alt=\"\" title=\"/><img src=url404 onerror=xss(8)>\">" );
test( "<img alt=\"<x\" title=\"\" src=\"/><img src=url404 onerror=xss(9)>\">" );
test( "<noscript/><img src=url404 onerror=xss(10)>" );
test( "<option><style></option></select><img src=url404 onerror=xss(11)></style>" );
// Support: iOS 8 - 12 only.
// Old iOS parses `<noembed>` tags differently, executing this code. This is no
// different to native behavior on that OS, though, so just accept it.
if ( !oldIos ) {
test( "<noembed><noembed/><img src=url404 onerror=xss(12)>" );
}
} );