20 lines
576 B
JavaScript
20 lines
576 B
JavaScript
|
import initIssueableApp from '~/issue_show';
|
||
|
|
|
||
|
|
describe('Issue show index', () => {
|
||
|
|
describe('initIssueableApp', () => {
|
||
|
|
it('should initialize app with no potential XSS attack', () => {
|
||
|
|
const d = document.createElement('div');
|
||
|
|
d.id = 'js-issuable-app-initial-data';
|
||
|
|
d.innerHTML = JSON.stringify({
|
||
|
|
initialDescriptionHtml: '<img src=x onerror=alert(1)>',
|
||
|
|
});
|
||
|
|
document.body.appendChild(d);
|
||
|
|
|
||
|
|
const alertSpy = spyOn(window, 'alert');
|
||
|
|
initIssueableApp();
|
||
|
|
|
||
|
|
expect(alertSpy).not.toHaveBeenCalled();
|
||
|
|
});
|
||
|
|
});
|
||
|
|
});
|