@@ -41,6 +41,16 @@ def test_default_scrub_behavior
4141 assert_scrubbed '<tag>hello</tag>' , 'hello'
4242 end
4343
44+ def test_default_scrub_removes_comments
45+ assert_scrubbed ( '<div>one</div><!-- two --><span>three</span>' ,
46+ '<div>one</div><span>three</span>' )
47+ end
48+
49+ def test_default_scrub_removes_processing_instructions
50+ assert_scrubbed ( '<div>one</div><?div two><span>three</span>' ,
51+ '<div>one</div><span>three</span>' )
52+ end
53+
4454 def test_default_attributes_removal_behavior
4555 assert_scrubbed '<p cooler="hello">hello</p>' , '<p>hello</p>'
4656 end
@@ -56,6 +66,12 @@ def test_leaves_only_supplied_tags
5666 assert_scrubbed html , '<tag>leave me now</tag>'
5767 end
5868
69+ def test_leaves_comments_when_supplied_as_tag
70+ @scrubber . tags = %w( div comment )
71+ assert_scrubbed ( '<div>one</div><!-- two --><span>three</span>' ,
72+ '<div>one</div><!-- two -->three' )
73+ end
74+
5975 def test_leaves_only_supplied_tags_nested
6076 html = '<tag>leave <em>me <span>now</span></em></tag>'
6177 @scrubber . tags = %w( tag )
@@ -112,50 +128,6 @@ def test_attributes_accessor_validation
112128 end
113129end
114130
115- class PermitScrubberSubclassTest < ScrubberTest
116- def setup
117- @scrubber = Class . new ( ::Rails ::Html ::PermitScrubber ) do
118- attr :nodes_seen
119-
120- def initialize
121- super ( )
122- @nodes_seen = [ ]
123- end
124-
125- def keep_node? ( node )
126- @nodes_seen << node . name
127- super ( node )
128- end
129- end . new
130- end
131-
132- def test_elements_are_checked
133- html = %Q("<div></div><a></a><tr></tr>")
134- Loofah . scrub_fragment ( html , @scrubber )
135- assert_includes ( @scrubber . nodes_seen , "div" )
136- assert_includes ( @scrubber . nodes_seen , "a" )
137- assert_includes ( @scrubber . nodes_seen , "tr" )
138- end
139-
140- def test_comments_are_checked
141- # this passes in v1.3.0 but fails in v1.4.0
142- html = %Q("<div></div><!-- ohai --><tr></tr>")
143- Loofah . scrub_fragment ( html , @scrubber )
144- assert_includes ( @scrubber . nodes_seen , "div" )
145- assert_includes ( @scrubber . nodes_seen , "comment" )
146- assert_includes ( @scrubber . nodes_seen , "tr" )
147- end
148-
149- def test_craftily_named_processing_instructions_are_not_checked
150- # this fails in v1.3.0 but passes in v1.4.0
151- html = %Q("<div></div><?a content><tr></tr>")
152- Loofah . scrub_fragment ( html , @scrubber )
153- assert_includes ( @scrubber . nodes_seen , "div" )
154- refute_includes ( @scrubber . nodes_seen , "a" )
155- assert_includes ( @scrubber . nodes_seen , "tr" )
156- end
157- end
158-
159131class TargetScrubberTest < ScrubberTest
160132 def setup
161133 @scrubber = Rails ::Html ::TargetScrubber . new
0 commit comments