diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js
index 6f0572451..3a606608d 100644
--- a/test/fixtures/expect.js
+++ b/test/fixtures/expect.js
@@ -1032,7 +1032,8 @@ module.exports = [
"",
"",
"",
- ""
+ "",
+ ""
]
}, {
"title": "Tests against mXSS behavior with MathML in Chrome 77 and alike",
@@ -1054,7 +1055,8 @@ module.exports = [
"",
"",
"",
- ""
+ "",
+ ""
]
}, {
"title": "Tests against mXSS behavior with MathML Templates in Chrome 77 and alike",
diff --git a/test/test-suite.js b/test/test-suite.js
index 239d65d28..2e11bf0f3 100644
--- a/test/test-suite.js
+++ b/test/test-suite.js
@@ -1644,6 +1644,7 @@
'',
'',
'',
+ "\" y=\""
]);
}
);
@@ -1735,6 +1736,7 @@
'',
'',
'',
+ ""
],
},
{
@@ -1742,6 +1744,7 @@
expected: [
'',
'',
+ ""
],
},
{
@@ -2095,80 +2098,6 @@
});
});
- QUnit.test('Test proper handling of nesting-based mXSS 1/3', function (assert) {
-
- let dirty = `${``.repeat(250)}${`
`.repeat(250)}`;
- let expected = `${``.repeat(250)}${`
`.repeat(250)}`;
- let clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- dirty = `${``.repeat(255)}${`
`.repeat(255)}`;
- expected = `${``.repeat(253)}${`
`.repeat(253)}`;
- clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- dirty = `${``.repeat(257)}${`
`.repeat(257)}`;
- expected = `${``.repeat(253)}${`
`.repeat(253)}`;
- clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- dirty = `${``.repeat(257)}${`
`.repeat(257)}`;
- expected = `${``.repeat(251)}${`
`.repeat(251)} `;
- clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- dirty = `${``.repeat(255)}${``.repeat(
- 255
- )} `;
- expected = ``;
- clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- });
-
- QUnit.test('Test proper handling of nesting-based mXSS 2/3', function (assert) {
-
- let dirty = ``,
- ];
- let clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- dirty = `${``.repeat(500)}${`
`.repeat(500)}`;
- expected = [
- `${``.repeat(253)}${`
`.repeat(253)}`,
- `${``.repeat(253)}${`
`.repeat(253)}`
- ];
- clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- dirty = ``,
- ];
- clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
-
- dirty = `${``.repeat(
- 500
- )}${`
`.repeat(500)}`;
- expected = [
- `${``.repeat(253)}${`
`.repeat(253)}`,
- `${``.repeat(
- 253
- )}${`
`.repeat(253)}`,
- ];
- clean = DOMPurify.sanitize(dirty);
- assert.contains(clean, expected);
- });
-
QUnit.test('Test proper handling of nesting-based mXSS 3/3', function (assert) {
let dirty = `