diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js index 6f0572451..3a606608d 100644 --- a/test/fixtures/expect.js +++ b/test/fixtures/expect.js @@ -1032,7 +1032,8 @@ module.exports = [ "\">", "\">", "", - "" + "", + "" ] }, { "title": "Tests against mXSS behavior with MathML in Chrome 77 and alike", @@ -1054,7 +1055,8 @@ module.exports = [ "", "", "", - "" + "", + "" ] }, { "title": "Tests against mXSS behavior with MathML Templates in Chrome 77 and alike", diff --git a/test/test-suite.js b/test/test-suite.js index 239d65d28..2e11bf0f3 100644 --- a/test/test-suite.js +++ b/test/test-suite.js @@ -1644,6 +1644,7 @@ '', '', '', + "\" y=\"" ]); } ); @@ -1735,6 +1736,7 @@ '', '', '', + "" ], }, { @@ -1742,6 +1744,7 @@ expected: [ '', '', + "" ], }, { @@ -2095,80 +2098,6 @@ }); }); - QUnit.test('Test proper handling of nesting-based mXSS 1/3', function (assert) { - - let dirty = `${`
`.repeat(250)}${`
`.repeat(250)}`; - let expected = `${`
`.repeat(250)}${`
`.repeat(250)}`; - let clean = DOMPurify.sanitize(dirty); - assert.contains(clean, expected); - - dirty = `${`
`.repeat(255)}${`
`.repeat(255)}`; - expected = `${`
`.repeat(253)}${`
`.repeat(253)}`; - clean = DOMPurify.sanitize(dirty); - assert.contains(clean, expected); - - dirty = `${`
`.repeat(257)}${`
`.repeat(257)}`; - expected = `${`
`.repeat(253)}${`
`.repeat(253)}`; - clean = DOMPurify.sanitize(dirty); - assert.contains(clean, expected); - - dirty = `