Skip to content
This repository has been archived by the owner on Aug 1, 2024. It is now read-only.

Commit

Permalink
Update sanitizer test vectors to assert that iframe srcdoc is dropped
Browse files Browse the repository at this point in the history
RELNOTES: n/a

PiperOrigin-RevId: 367390735
  • Loading branch information
Closure Team authored and 12wrigja committed Apr 8, 2021
1 parent a33a9c8 commit 7d07947
Showing 1 changed file with 1 addition and 12 deletions.
13 changes: 1 addition & 12 deletions closure/goog/html/sanitizer/html_test_vectors.js
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,7 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
{input: "<iframe srcdoc=\"&lt;img src&equals;x:x onerror&equals;alert&lpar;xss&rpar;&gt;\" />",
acceptable: [
"",
"<iframe srcdoc=\"&lt;img src=&#34;about:invalid#zGoSafez&#34;/&gt;\"></iframe>",
"<iframe srcdoc=\"&lt;img src=&quot;about:invalid#zCSafez&quot;&gt;\"></iframe>",
"<iframe srcdoc=\"<img src=&quot;about:invalid#zCSafez&quot;>\"></iframe>",
"<iframe srcdoc=\"&lt;img src=&quot;about:invalid#zCSafez&quot; /&gt;\"></iframe>",
"<iframe srcdoc=\"&lt;img src=&quot;about:invalid#zTSz&quot; /&gt;\"></iframe>",
"<iframe></iframe>",
],
name: "iframe_srcdoc"},
{input: "<img src=\"javascript:alert('xss');\">",
Expand Down Expand Up @@ -16899,13 +16895,6 @@ goog.html.htmlTestVectors.HTML_TEST_VECTORS = [
"<table><td></td></table>",
],
name: "contract_iframe_scriptinside"},
{input: "<iframe srcdoc=\"<script>alert()</script>\">",
acceptable: [
"<iframe srcdoc></iframe>",
"<iframe srcdoc=\"\"></iframe>",
"",
],
name: "contract_iframe_srcdoc"},
{input: "<iframe loading=\"x\"></iframe>",
acceptable: [
"<iframe></iframe>",
Expand Down

0 comments on commit 7d07947

Please sign in to comment.