hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

CommonAPI: Escape HTML for chat messages.

Browse source
This commit is contained in:
lain 2020-04-16 12:56:29 +02:00
commit 3d4eca5dd4
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
test/web/common_api/common_api_test.exs
View file

@ -27,7 +27,12 @@ defmodule Pleroma.Web.CommonAPITest do
author = insert(:user)
recipient = insert(:user)
{:ok, activity} = CommonAPI.post_chat_message(author, recipient, "a test message")
{:ok, activity} =
CommonAPI.post_chat_message(
author,
recipient,
"a test message <script>alert('uuu')</script>"
)
assert activity.data["type"] == "Create"
assert activity.local
@ -35,7 +40,9 @@ defmodule Pleroma.Web.CommonAPITest do
assert object.data["type"] == "ChatMessage"
assert object.data["to"] == [recipient.ap_id]
assert object.data["content"] == "a test message"
assert object.data["content"] ==
"a test message &lt;script&gt;alert(&#39;uuu&#39;)&lt;/script&gt;"
assert Chat.get(author.id, recipient.ap_id)
assert Chat.get(recipient.id, author.ap_id)