X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=test%2Fweb%2Fcommon_api%2Fcommon_api_test.exs;h=cd5aca961031187b1d70e4cfdc1ca16ebede6d9b;hb=a26d5e6b2aba5010c699df659d63048957b347a5;hp=2a2c40833839bfbd28f9890c2a6fc1cc161687c7;hpb=440b459cd14778e155cd6a3550847b1277fbd1f1;p=akkoma

diff --git a/test/web/common_api/common_api_test.exs b/test/web/common_api/common_api_test.exs
index 2a2c40833..cd5aca961 100644
--- a/test/web/common_api/common_api_test.exs
+++ b/test/web/common_api/common_api_test.exs
@@ -21,4 +21,36 @@ defmodule Pleroma.Web.CommonAPI.Test do
 
     assert karjalanpiirakka["name"] == ":karjalanpiirakka:"
   end
+
+  describe "posting" do
+    test "it filters out obviously bad tags when accepting a post as HTML" do
+      user = insert(:user)
+
+      post = "<h1>2hu</h1><script>alert('xss')</script>"
+
+      {:ok, activity} =
+        CommonAPI.post(user, %{
+          "status" => post,
+          "content_type" => "text/html"
+        })
+
+      content = activity.data["object"]["content"]
+      assert content == "<h1>2hu</h1>alert('xss')"
+    end
+
+    test "it filters out obviously bad tags when accepting a post as Markdown" do
+      user = insert(:user)
+
+      post = "<h1>2hu</h1><script>alert('xss')</script>"
+
+      {:ok, activity} =
+        CommonAPI.post(user, %{
+          "status" => post,
+          "content_type" => "text/markdown"
+        })
+
+      content = activity.data["object"]["content"]
+      assert content == "<h1>2hu</h1>alert('xss')"
+    end
+  end
 end