Fixed the tests to reflect the new sanitzer checks

cure53 · Oct 14, 2019 · 884e248 · 884e248
1 parent d37a93a
commit 884e248
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js
@@ -894,7 +894,8 @@ module.exports = [
           "<div id=\"129\"><svg xmlns=\"http://www.w3.org/2000/svg\"><image style=\"filter:url(&quot;data:image/svg+xml,&lt;svg xmlns=%22http://www.w3.org/2000/svg%22&gt;&lt;script&gt;parent.alert(129)&lt;/script&gt;&lt;/svg&gt;&quot;)\">\n\n</image></image></svg>//[\"'`--&gt;]]&gt;]</div>",
           "<div id=\"129\"><svg xmlns=\"http://www.w3.org/2000/svg\"><image style=\"filter:url(&quot;data:image/svg+xml,&lt;svg xmlns=%22http://www.w3.org/2000/svg%22&gt;&lt;script&gt;parent.alert(129)&lt;/script&gt;&lt;/svg&gt;&quot;)\">\n\n</image></svg>//[\"'`--&gt;]]&gt;]</div>",
           "<div id=\"129\"><svg></svg>//[\"'`--&gt;]]&gt;]</div>",
-          "<div id=\"129\"><svg xmlns=\"http://www.w3.org/2000/svg\" />//[\"'`--&gt;]]&gt;]</div>"
+          "<div id=\"129\"><svg xmlns=\"http://www.w3.org/2000/svg\" />//[\"'`--&gt;]]&gt;]</div>",
+          "<div id=\"129\"><svg><image>\n\n</image></svg>//[\"'`--&gt;]]&gt;]</div>"
       ]
   }, {
       "title": "MathML",

diff --git a/test/test-suite.js b/test/test-suite.js
@@ -386,7 +386,7 @@ module.exports = function(DOMPurify, window, tests, xssTests) {
   QUnit.test( 'DOMPurify.removed should be correct in SAFE_FOR_JQUERY mode', function (assert) {
       var dirty = '<option><iframe></select><b><script>alert(1)<\/script>';
       DOMPurify.sanitize(dirty, {SAFE_FOR_JQUERY: true});
-      assert.equal(DOMPurify.removed.length, 2);
+      assert.equal(DOMPurify.removed.length, 1);
   } );
 
   // Test 8 to check that DOMPurify.removed is correct if tags are clean
@@ -640,8 +640,7 @@ module.exports = function(DOMPurify, window, tests, xssTests) {
       };
       var clean = DOMPurify.sanitize("x<noframes><svg><b><xmp><b title='</xmp><img src=x onerror=alert(1)>'>", config)
       assert.contains(clean, [
-          "<math><b><style><b title=\"</style></b></math>",
-          "<math></math>"
+          "x"
       ]);
   } );
 };