| Index: tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart
|
| diff --git a/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart b/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart
|
| index cb0196d7393693b2d0fa3f8ce35dc06b31ca91a2..4a5fe71550fd2b61ecb64cbb17e4fa10b4fbc4a1 100644
|
| --- a/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart
|
| +++ b/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart
|
| @@ -137,6 +137,24 @@ main() {
|
|
|
| validateNodeTree(template.content, expectedContent);
|
| });
|
| +
|
| + test("appendHtml is sanitized", () {
|
| + var html = '<body background="s"></body><div></div>';
|
| + document.body.appendHtml('<div id="stuff"></div>');
|
| + var stuff = document.querySelector("#stuff");
|
| + stuff.appendHtml(html);
|
| + expect(stuff.childNodes.length, 1);
|
| + stuff.remove();
|
| + });
|
| +
|
| + test("documentFragment.appendHtml is sanitized", () {
|
| + var html = '<div id="things></div>';
|
| + var fragment = new DocumentFragment.html(html);
|
| + fragment.appendHtml('<div id="bad"><script></script></div>');
|
| + expect(fragment.childNodes.length, 1);
|
| + expect(fragment.childNodes[0].id, "bad");
|
| + expect(fragment.childNodes[0].childNodes.length, 0);
|
| + });
|
| });
|
|
|
| group('URI_sanitization', () {
|
|
|