(t *testing.T)
| 11 | ) |
| 12 | |
| 13 | func TestDetectXSS(t *testing.T) { |
| 14 | var a = assert.NewAssertion(t) |
| 15 | a.IsFalse(injectionutils.DetectXSS("", true)) |
| 16 | a.IsFalse(injectionutils.DetectXSS("abc", true)) |
| 17 | a.IsTrue(injectionutils.DetectXSS("<script>", true)) |
| 18 | a.IsTrue(injectionutils.DetectXSS("<link>", true)) |
| 19 | a.IsFalse(injectionutils.DetectXSS("<html><span>", true)) |
| 20 | a.IsFalse(injectionutils.DetectXSS("<script>", true)) |
| 21 | a.IsTrue(injectionutils.DetectXSS("/path?onmousedown=a", true)) |
| 22 | a.IsTrue(injectionutils.DetectXSS("/path?onkeyup=a", true)) |
| 23 | a.IsTrue(injectionutils.DetectXSS("onkeyup=a", true)) |
| 24 | a.IsTrue(injectionutils.DetectXSS("<iframe scrolling='no'>", true)) |
| 25 | a.IsFalse(injectionutils.DetectXSS("<html><body><span>RequestId: 1234567890</span></body></html>", true)) |
| 26 | a.IsTrue(injectionutils.DetectXSS("name=s&description=%3Cscript+src%3D%22a.js%22%3Edddd%3C%2Fscript%3E", true)) |
| 27 | a.IsFalse(injectionutils.DetectXSS(`<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0"> |
| 28 | <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> |
| 29 | <rdf:Description rdf:about="" |
| 30 | xmlns:tiff="http://ns.adobe.com/tiff/1.0/"> |
| 31 | <tiff:Orientation>1</tiff:Orientation> |
| 32 | </rdf:Description> |
| 33 | </rdf:RDF> |
| 34 | </x:xmpmeta>`, true)) // included in some photo files |
| 35 | a.IsFalse(injectionutils.DetectXSS(`<xml></xml>`, false)) |
| 36 | } |
| 37 | |
| 38 | func TestDetectXSS_Strict(t *testing.T) { |
| 39 | var a = assert.NewAssertion(t) |
nothing calls this directly
no test coverage detected