X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=test%2Fweb%2Fcommon_api%2Fcommon_api_test.exs;h=cd5aca961031187b1d70e4cfdc1ca16ebede6d9b;hb=a26d5e6b2aba5010c699df659d63048957b347a5;hp=b597e6e0aa62587ff5ff8582cfc042a4f1ba5c3a;hpb=0b5bc62b33a655488afe73b35945adcbab11300d;p=akkoma

diff --git a/test/web/common_api/common_api_test.exs b/test/web/common_api/common_api_test.exs
index b597e6e0a..cd5aca961 100644
--- a/test/web/common_api/common_api_test.exs
+++ b/test/web/common_api/common_api_test.exs
@@ -1,6 +1,7 @@
-defmodule Pleroma.Web.CommonAPI.UtilsTest do
+defmodule Pleroma.Web.CommonAPI.Test do
   use Pleroma.DataCase
   alias Pleroma.Web.CommonAPI
+  alias Pleroma.User
 
   import Pleroma.Factory
 
@@ -10,4 +11,46 @@ defmodule Pleroma.Web.CommonAPI.UtilsTest do
 
     assert activity.data["object"]["tag"] == ["2hu"]
   end
+
+  test "it adds emoji when updating profiles" do
+    user = insert(:user, %{name: ":karjalanpiirakka:"})
+
+    CommonAPI.update(user)
+    user = User.get_cached_by_ap_id(user.ap_id)
+    [karjalanpiirakka] = user.info["source_data"]["tag"]
+
+    assert karjalanpiirakka["name"] == ":karjalanpiirakka:"
+  end
+
+  describe "posting" do
+    test "it filters out obviously bad tags when accepting a post as HTML" do
+      user = insert(:user)
+
+      post = "<h1>2hu</h1><script>alert('xss')</script>"
+
+      {:ok, activity} =
+        CommonAPI.post(user, %{
+          "status" => post,
+          "content_type" => "text/html"
+        })
+
+      content = activity.data["object"]["content"]
+      assert content == "<h1>2hu</h1>alert('xss')"
+    end
+
+    test "it filters out obviously bad tags when accepting a post as Markdown" do
+      user = insert(:user)
+
+      post = "<h1>2hu</h1><script>alert('xss')</script>"
+
+      {:ok, activity} =
+        CommonAPI.post(user, %{
+          "status" => post,
+          "content_type" => "text/markdown"
+        })
+
+      content = activity.data["object"]["content"]
+      assert content == "<h1>2hu</h1>alert('xss')"
+    end
+  end
 end