19 lines
595 B
Python
19 lines
595 B
Python
import pytest
|
|
|
|
from apps.jobs.services.sanitize import sanitize_job_html
|
|
|
|
|
|
@pytest.mark.security
|
|
def test_sanitize_removes_script_handlers_forms_and_iframes():
|
|
dirty = (
|
|
'<p onclick="alert(1)">Hallo</p><script>alert(1)</script>'
|
|
'<iframe src="x"></iframe><form><input></form>'
|
|
'<a href="javascript:alert(1)">x</a>'
|
|
)
|
|
clean = sanitize_job_html(dirty)
|
|
assert "script" not in clean.lower()
|
|
assert "onclick" not in clean.lower()
|
|
assert "iframe" not in clean.lower()
|
|
assert "form" not in clean.lower()
|
|
assert "javascript:" not in clean.lower()
|