X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=test%2Fweb%2Fstatic_fe%2Fstatic_fe_controller_test.exs;h=aabbedb17afc368d775d006fe6e7cb1194ee3dee;hb=0e27c274f4f68f3385753a2482d881bae7c35a06;hp=a072cc78faaf5580456fe1f06d3036a1811adee8;hpb=fa4ec17c841a65eccacdc35c98b6c047549b305b;p=akkoma

diff --git a/test/web/static_fe/static_fe_controller_test.exs b/test/web/static_fe/static_fe_controller_test.exs
index a072cc78f..aabbedb17 100644
--- a/test/web/static_fe/static_fe_controller_test.exs
+++ b/test/web/static_fe/static_fe_controller_test.exs
@@ -8,13 +8,9 @@ defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do
 
   import Pleroma.Factory
 
-  clear_config_all([:static_fe, :enabled]) do
-    Config.put([:static_fe, :enabled], true)
-  end
+  clear_config_all([:static_fe, :enabled], true)
 
-  clear_config([:instance, :federating]) do
-    Config.put([:instance, :federating], true)
-  end
+  clear_config([:instance, :federating], true)
 
   setup %{conn: conn} do
     conn = put_req_header(conn, "accept", "text/html")
@@ -92,6 +88,19 @@ defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do
       assert html =~ "testing a thing!"
     end
 
+    test "filters HTML tags", %{conn: conn} do
+      user = insert(:user)
+      {:ok, activity} = CommonAPI.post(user, %{"status" => "<script>alert('xss')</script>"})
+
+      conn =
+        conn
+        |> put_req_header("accept", "text/html")
+        |> get("/notice/#{activity.id}")
+
+      html = html_response(conn, 200)
+      assert html =~ ~s[&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;]
+    end
+
     test "shows the whole thread", %{conn: conn, user: user} do
       {:ok, activity} = CommonAPI.post(user, %{"status" => "space: the final frontier"})