-
Notifications
You must be signed in to change notification settings - Fork 208
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ZK-5766: DomPurify fails with partial html content
- Loading branch information
1 parent
fac6ce0
commit 6204ecd
Showing
5 changed files
with
69 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
|
|
||
| <!-- | ||
| B101-ZK-5766.zul | ||
| Purpose: | ||
| Description: | ||
| History: | ||
| 2024/8/15, Created by jumperchen | ||
| Copyright (C) 2024 Potix Corporation. All Rights Reserved. | ||
| --> | ||
| <zk> | ||
| <div> | ||
| <zscript> | ||
| <![CDATA[ | ||
| String anotherTooltip = "TEST <a test>...</a> should display in tooltip"; | ||
| String anotherTooltip2 = "TEST <a href>...</a> should display in tooltip"; | ||
| ]]> | ||
| </zscript> | ||
|
|
||
| <a tooltiptext="${anotherTooltip}" label="Click here for XSS"/> | ||
| <button sclass="${anotherTooltip2}" label="Click here for XSS"/> | ||
|
|
||
| <div tooltiptext="${anotherTooltip}">looks ok but</div> | ||
| <div tooltiptext="${anotherTooltip2}">this causes a problem</div> | ||
| <window title="click here for xss" sclass="${anotherTooltip2}"></window> | ||
| </div> | ||
| </zk> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
30 changes: 30 additions & 0 deletions
30
zktest/src/test/java/org/zkoss/zktest/zats/test2/B101_ZK_5766Test.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| /* B101_ZK_5766Test.java | ||
| Purpose: | ||
| Description: | ||
| History: | ||
| 5:06 PM 2024/8/15, Created by jumperchen | ||
| Copyright (C) 2024 Potix Corporation. All Rights Reserved. | ||
| */ | ||
| package org.zkoss.zktest.zats.test2; | ||
|
|
||
| import static org.junit.jupiter.api.Assertions.assertEquals; | ||
|
|
||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import org.zkoss.test.webdriver.WebDriverTestCase; | ||
|
|
||
| /** | ||
| * @author jumperchen | ||
| */ | ||
| public class B101_ZK_5766Test extends WebDriverTestCase { | ||
|
|
||
| @Test | ||
| public void test() { | ||
| connect(); | ||
| assertEquals(0, jq("div>:contains(\"should display in tooltip\")").length()); | ||
| } | ||
| } |