From afe20b79a64266e64011f34b26a30b3d1c62fd47 Mon Sep 17 00:00:00 2001 From: Michał Gołębiowski-Owczarek Date: Wed, 12 May 2021 00:59:42 +0200 Subject: Datepicker: Make sure text option are text, shorten HTML strings Instead of using enormous HTML strings, various elements are now constructed using jQuery APIs. This makes it more obvious user-provided data is used correctly. Fixes #15284 Closes gh-1953 --- tests/unit/datepicker/options.js | 51 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) (limited to 'tests/unit') diff --git a/tests/unit/datepicker/options.js b/tests/unit/datepicker/options.js index e5e938a0f..e58b9a75d 100644 --- a/tests/unit/datepicker/options.js +++ b/tests/unit/datepicker/options.js @@ -1171,4 +1171,55 @@ QUnit.test( "Ticket 7602: Stop datepicker from appearing with beforeShow event h inp.datepicker( "destroy" ); } ); +QUnit.test( "Ticket #15284: escaping text parameters", function( assert ) { + assert.expect( 7 ); + + var done = assert.async(); + + var qf = $( "#qunit-fixture" ); + + window.uiGlobalXss = []; + + var inp = testHelper.init( "#inp", { + showButtonPanel: true, + showOn: "both", + prevText: "", + nextText: "", + currentText: "", + closeText: "", + buttonText: "", + appendText: "" + } ); + + var dp = $( "#ui-datepicker-div" ); + + testHelper.onFocus( inp, function() { + assert.equal( dp.find( ".ui-datepicker-prev" ).text().trim(), + "", + "prevText escaped" ); + assert.equal( dp.find( ".ui-datepicker-next" ).text().trim(), + "", + "nextText escaped" ); + assert.equal( dp.find( ".ui-datepicker-current" ).text().trim(), + "", + "currentText escaped" ); + assert.equal( dp.find( ".ui-datepicker-close" ).text().trim(), + "", + "closeText escaped" ); + + assert.equal( qf.find( ".ui-datepicker-trigger" ).text().trim(), + "", + "buttonText escaped" ); + assert.equal( qf.find( ".ui-datepicker-append" ).text().trim(), + "", + "appendText escaped" ); + + assert.deepEqual( window.uiGlobalXss, [], "No XSS" ); + + delete window.uiGlobalXss; + inp.datepicker( "hide" ).datepicker( "destroy" ); + done(); + } ); +} ); + } ); -- cgit v1.2.3