2019-09-18 18:25:06 +02:00
|
|
|
import { mermaidUrl } from '../../helpers/util.js';
|
|
|
|
describe('XSS', () => {
|
|
|
|
it('should handle xss in tags', () => {
|
2021-11-18 19:17:00 +01:00
|
|
|
const str =
|
|
|
|
'eyJjb2RlIjoiXG5ncmFwaCBMUlxuICAgICAgQi0tPkQoPGltZyBvbmVycm9yPWxvY2F0aW9uPWBqYXZhc2NyaXB0XFx1MDAzYXhzc0F0dGFja1xcdTAwMjhkb2N1bWVudC5kb21haW5cXHUwMDI5YCBzcmM9eD4pOyIsIm1lcm1haWQiOnsidGhlbWUiOiJkZWZhdWx0In19';
|
2019-09-18 18:25:06 +02:00
|
|
|
|
2021-11-18 19:17:00 +01:00
|
|
|
const url = mermaidUrl(str, {}, true);
|
2019-09-18 18:25:06 +02:00
|
|
|
|
|
|
|
cy.visit(url);
|
2021-11-18 19:17:00 +01:00
|
|
|
cy.wait(1000).then(() => {
|
2019-12-07 12:19:45 +01:00
|
|
|
cy.get('.mermaid').should('exist');
|
|
|
|
});
|
2021-11-18 19:17:00 +01:00
|
|
|
cy.get('svg');
|
|
|
|
});
|
2021-03-11 19:51:05 +01:00
|
|
|
|
|
|
|
it('should not allow tags in the css', () => {
|
2021-11-18 19:17:00 +01:00
|
|
|
const str =
|
|
|
|
'eyJjb2RlIjoiJSV7aW5pdDogeyAnZm9udEZhbWlseSc6ICdcXFwiPjwvc3R5bGU-PGltZyBzcmM9eCBvbmVycm9yPXhzc0F0dGFjaygpPid9IH0lJVxuZ3JhcGggTFJcbiAgICAgQSAtLT4gQiIsIm1lcm1haWQiOnsidGhlbWUiOiJkZWZhdWx0IiwiZmxvd2NoYXJ0Ijp7Imh0bWxMYWJlbHMiOmZhbHNlfX0sInVwZGF0ZUVkaXRvciI6ZmFsc2V9';
|
2021-03-11 19:51:05 +01:00
|
|
|
|
2021-11-18 19:17:00 +01:00
|
|
|
const url = mermaidUrl(
|
|
|
|
str,
|
|
|
|
{
|
|
|
|
theme: 'default',
|
|
|
|
flowchart: {
|
|
|
|
htmlMode: false,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
true
|
|
|
|
);
|
2021-03-11 19:51:05 +01:00
|
|
|
|
|
|
|
cy.visit(url);
|
2021-11-18 19:17:00 +01:00
|
|
|
cy.wait(1000).then(() => {
|
2021-03-11 19:51:05 +01:00
|
|
|
cy.get('#the-malware').should('not.exist');
|
|
|
|
});
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-03-11 19:51:05 +01:00
|
|
|
|
2019-12-07 12:19:45 +01:00
|
|
|
it('should handle xss in tags in non-html mode', () => {
|
2021-11-18 19:17:00 +01:00
|
|
|
const str =
|
|
|
|
'eyJjb2RlIjoiXG5ncmFwaCBMUlxuICAgICAgQi0tPkQoPGltZyBvbmVycm9yPWxvY2F0aW9uPWBqYXZhc2NyaXB0XFx1MDAzYXhzc0F0dGFja1xcdTAwMjhkb2N1bWVudC5kb21haW5cXHUwMDI5YCBzcmM9eD4pOyIsIm1lcm1haWQiOnsidGhlbWUiOiJkZWZhdWx0IiwiZmxvd2NoYXJ0Ijp7Imh0bWxMYWJlbHMiOmZhbHNlfX19';
|
2019-12-07 12:19:45 +01:00
|
|
|
|
2021-11-18 19:17:00 +01:00
|
|
|
const url = mermaidUrl(
|
|
|
|
str,
|
|
|
|
{
|
|
|
|
theme: 'default',
|
|
|
|
flowchart: {
|
|
|
|
htmlMode: false,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
true
|
|
|
|
);
|
2019-12-07 12:19:45 +01:00
|
|
|
|
|
|
|
cy.visit(url);
|
2021-11-18 19:17:00 +01:00
|
|
|
cy.wait(1000);
|
2019-09-18 18:25:06 +02:00
|
|
|
|
2021-03-11 19:51:05 +01:00
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-03-11 19:51:05 +01:00
|
|
|
|
|
|
|
it('should not allow changing the __proto__ attribute using config', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss2.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-06-03 20:47:24 +02:00
|
|
|
it('should not allow maniplulating htmlLabels into a false positive', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss4.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-06-08 20:08:04 +02:00
|
|
|
it('should not allow maniplulating antiscript to run javascript', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss5.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-06-27 00:24:19 +02:00
|
|
|
it('should not allow maniplulating antiscript to run javascript using onerror', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss6.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-09-29 08:52:12 +02:00
|
|
|
it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre wrapper', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss8.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-09-29 08:52:12 +02:00
|
|
|
it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss9.html');
|
2021-09-29 08:45:07 +02:00
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-11-17 20:08:39 +01:00
|
|
|
it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss10.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-11-17 20:08:39 +01:00
|
|
|
it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss11.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-11-17 20:08:39 +01:00
|
|
|
it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss12.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-11-17 20:08:39 +01:00
|
|
|
it('should not allow maniplulating antiscript to run javascript using onerror in state diagrams with dagre d3', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss13.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|
2021-12-07 22:54:28 +01:00
|
|
|
it('should not allow maniplulating antiscript to run javascript iframes in class diagrams', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss14.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
|
|
|
});
|
2021-11-18 19:17:00 +01:00
|
|
|
});
|