Function runXssCase

test/jasmine/tests/toimage_test.js:296–306

(payload, done)

        };

        const runXssCase = (payload, done) => {
            const fig = {
                data: [{ x: [1], y: [1], type: 'scatter' }],
                layout: { annotations: [{ x: 1, y: 1, showarrow: false, text: payload }] }
            };

            Plotly.newPlot(gd, fig)
                .then(() => Plotly.toImage(gd, { format: 'svg', imageDataOnly: true }))
                .then((svg) => expectNoEventHandlerAttrs(decodeURIComponent(svg)))
                .then(done, done.fail);
        };

        it('should not let <span style=...> entity-encoded quotes escape attribute context', (done) => {
            runXssCase('<span style="x:&#34; onmouseover=&#34;__xss=1&#34; a=&#34;">hi</span>', done);