2019-09-18 18:25:06 +02:00
|
|
|
/* eslint-env jest */
|
|
|
|
import { mermaidUrl } from '../../helpers/util.js';
|
|
|
|
|
|
|
|
/* eslint-disable */
|
|
|
|
describe('XSS', () => {
|
|
|
|
it('should handle xss in tags', () => {
|
|
|
|
const str = 'eyJjb2RlIjoiXG5ncmFwaCBMUlxuICAgICAgQi0tPkQoPGltZyBvbmVycm9yPWxvY2F0aW9uPWBqYXZhc2NyaXB0XFx1MDAzYXhzc0F0dGFja1xcdTAwMjhkb2N1bWVudC5kb21haW5cXHUwMDI5YCBzcmM9eD4pOyIsIm1lcm1haWQiOnsidGhlbWUiOiJkZWZhdWx0In19';
|
|
|
|
|
|
|
|
const url = mermaidUrl(str,{}, true);
|
|
|
|
|
|
|
|
cy.visit(url);
|
2019-12-07 12:19:45 +01:00
|
|
|
cy.wait(1000).then(()=>{
|
|
|
|
cy.get('.mermaid').should('exist');
|
|
|
|
});
|
2019-09-18 18:25:06 +02:00
|
|
|
cy.get('svg')
|
2021-03-11 19:51:05 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
it('should not allow tags in the css', () => {
|
|
|
|
const str = 'eyJjb2RlIjoiJSV7aW5pdDogeyAnZm9udEZhbWlseSc6ICdcXFwiPjwvc3R5bGU-PGltZyBzcmM9eCBvbmVycm9yPXhzc0F0dGFjaygpPid9IH0lJVxuZ3JhcGggTFJcbiAgICAgQSAtLT4gQiIsIm1lcm1haWQiOnsidGhlbWUiOiJkZWZhdWx0IiwiZmxvd2NoYXJ0Ijp7Imh0bWxMYWJlbHMiOmZhbHNlfX0sInVwZGF0ZUVkaXRvciI6ZmFsc2V9';
|
|
|
|
|
|
|
|
const url = mermaidUrl(str,{
|
|
|
|
"theme": "default",
|
|
|
|
"flowchart": {
|
|
|
|
"htmlMode": false
|
|
|
|
}
|
|
|
|
}, true);
|
|
|
|
|
|
|
|
cy.visit(url);
|
|
|
|
cy.wait(1000).then(()=>{
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
|
|
|
});
|
2019-12-07 12:19:45 +01:00
|
|
|
|
|
|
|
})
|
2021-03-11 19:51:05 +01:00
|
|
|
|
2019-12-07 12:19:45 +01:00
|
|
|
it('should handle xss in tags in non-html mode', () => {
|
|
|
|
const str = 'eyJjb2RlIjoiXG5ncmFwaCBMUlxuICAgICAgQi0tPkQoPGltZyBvbmVycm9yPWxvY2F0aW9uPWBqYXZhc2NyaXB0XFx1MDAzYXhzc0F0dGFja1xcdTAwMjhkb2N1bWVudC5kb21haW5cXHUwMDI5YCBzcmM9eD4pOyIsIm1lcm1haWQiOnsidGhlbWUiOiJkZWZhdWx0IiwiZmxvd2NoYXJ0Ijp7Imh0bWxMYWJlbHMiOmZhbHNlfX19';
|
|
|
|
|
|
|
|
const url = mermaidUrl(str,{
|
|
|
|
"theme": "default",
|
|
|
|
"flowchart": {
|
|
|
|
"htmlMode": false
|
|
|
|
}
|
|
|
|
}, true);
|
|
|
|
|
|
|
|
cy.visit(url);
|
2021-03-11 19:51:05 +01:00
|
|
|
cy.wait(1000)
|
2019-09-18 18:25:06 +02:00
|
|
|
|
2021-03-11 19:51:05 +01:00
|
|
|
cy.get('#the-malware').should('not.exist');
|
2019-09-18 18:25:06 +02:00
|
|
|
})
|
2021-03-11 19:51:05 +01:00
|
|
|
|
|
|
|
it('should not allow changing the __proto__ attribute using config', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss2.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
|
|
|
})
|
2021-06-03 20:47:24 +02:00
|
|
|
it('should not allow maniplulating htmlLabels into a false positive', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss4.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
|
|
|
})
|
2021-06-08 20:08:04 +02:00
|
|
|
it('should not allow maniplulating antiscript to run javascript', () => {
|
|
|
|
cy.visit('http://localhost:9000/xss5.html');
|
|
|
|
cy.wait(1000);
|
|
|
|
cy.get('#the-malware').should('not.exist');
|
|
|
|
})
|
2021-03-11 19:51:05 +01:00
|
|
|
|
2019-09-18 18:25:06 +02:00
|
|
|
})
|