1
1
'use strict' ;
2
2
3
3
describe ( 'HTML' , function ( ) {
4
+ var ua = window . navigator . userAgent ;
5
+ var isChrome = / C h r o m e / . test ( ua ) && ! / E d g e / . test ( ua ) ;
4
6
5
7
var expectHTML ;
6
8
@@ -222,7 +224,7 @@ describe('HTML', function() {
222
224
. toEqual ( '' ) ;
223
225
} ) ;
224
226
225
- if ( / C h r o m e / . test ( window . navigator . userAgent ) ) {
227
+ if ( isChrome ) {
226
228
it ( 'should prevent mXSS attacks' , function ( ) {
227
229
expectHTML ( '<a href=" javascript:alert(1)">CLICKME</a>' ) . toBe ( '<a>CLICKME</a>' ) ;
228
230
} ) ;
@@ -245,7 +247,8 @@ describe('HTML', function() {
245
247
expectHTML ( '<svg width="400px" height="150px" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red"></svg>' )
246
248
. toBeOneOf ( '<svg width="400px" height="150px" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red"></circle></svg>' ,
247
249
'<svg xmlns="http://www.w3.org/2000/svg" height="150px" width="400px"><circle fill="red" stroke-width="3" stroke="black" r="40" cy="50" cx="50"></circle></svg>' ,
248
- '<svg width="400px" height="150px" xmlns="http://www.w3.org/2000/svg"><circle fill="red" stroke="black" stroke-width="3" cx="50" cy="50" r="40"></circle></svg>' ) ;
250
+ '<svg width="400px" height="150px" xmlns="http://www.w3.org/2000/svg"><circle fill="red" stroke="black" stroke-width="3" cx="50" cy="50" r="40"></circle></svg>' ,
251
+ '<svg width="400px" height="150px" xmlns="http://www.w3.org/2000/svg"><circle FILL="red" STROKE="black" STROKE-WIDTH="3" cx="50" cy="50" r="40"></circle></svg>' ) ;
249
252
} ) ;
250
253
251
254
it ( 'should not ignore white-listed svg camelCased attributes' , function ( ) {
@@ -283,6 +286,7 @@ describe('HTML', function() {
283
286
it ( 'should not accept SVG animation tags' , function ( ) {
284
287
expectHTML ( '<svg xmlns:xlink="http://www.w3.org/1999/xlink"><a><text y="1em">Click me</text><animate attributeName="xlink:href" values="javascript:alert(1)"/></a></svg>' )
285
288
. toBeOneOf ( '<svg xmlns:xlink="http://www.w3.org/1999/xlink"><a><text y="1em">Click me</text></a></svg>' ,
289
+ '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><a><text y="1em">Click me</text></a></svg>' ,
286
290
'<svg xmlns="http://www.w3.org/2000/svg"><a><text y="1em">Click me</text></a></svg>' ) ;
287
291
288
292
expectHTML ( '<svg><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="?"><circle r="400"></circle>' +
0 commit comments