Index: tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart |
diff --git a/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart b/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart |
index cb0196d7393693b2d0fa3f8ce35dc06b31ca91a2..4a5fe71550fd2b61ecb64cbb17e4fa10b4fbc4a1 100644 |
--- a/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart |
+++ b/tests/html/node_validator_important_if_you_suppress_make_the_bug_critical_test.dart |
@@ -137,6 +137,24 @@ main() { |
validateNodeTree(template.content, expectedContent); |
}); |
+ |
+ test("appendHtml is sanitized", () { |
+ var html = '<body background="s"></body><div></div>'; |
+ document.body.appendHtml('<div id="stuff"></div>'); |
+ var stuff = document.querySelector("#stuff"); |
+ stuff.appendHtml(html); |
+ expect(stuff.childNodes.length, 1); |
+ stuff.remove(); |
+ }); |
+ |
+ test("documentFragment.appendHtml is sanitized", () { |
+ var html = '<div id="things></div>'; |
+ var fragment = new DocumentFragment.html(html); |
+ fragment.appendHtml('<div id="bad"><script></script></div>'); |
+ expect(fragment.childNodes.length, 1); |
+ expect(fragment.childNodes[0].id, "bad"); |
+ expect(fragment.childNodes[0].childNodes.length, 0); |
+ }); |
}); |
group('URI_sanitization', () { |