You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have a few tests that compares HTML content. It shows the HTML diff as needed in console. But the HTML content is not not escaped and renders as html instead of text. This allows one to arbitrarily inject any html element in the web reporter.
Personally, I don't think executing arbitrary script in vitest web ui is any big deal, but its annoying while trying to see the errors.
Describe the bug
I have a few tests that compares HTML content. It shows the HTML diff as needed in console. But the HTML content is not not escaped and renders as html instead of text. This allows one to arbitrarily inject any html element in the web reporter.
Personally, I don't think executing arbitrary script in vitest web ui is any big deal, but its annoying while trying to see the errors.
Reproduction
The reproduction is at https://stackblitz.com/edit/vitest-dev-vitest-fgckzr?file=test%2Fhtml.test.ts&initialPath=__vitest__/
for the script and style to be injected, open the first test fail report
It should apply a green border to everything and show an alert
![image](https://private-user-images.githubusercontent.com/130567419/309279755-8c2b072c-6d6d-4def-90ca-a34389a147ce.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxNzI0MzQsIm5iZiI6MTcyNjE3MjEzNCwicGF0aCI6Ii8xMzA1Njc0MTkvMzA5Mjc5NzU1LThjMmIwNzJjLTZkNmQtNGRlZi05MGNhLWEzNDM4OWExNDdjZS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTEyJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkxMlQyMDE1MzRaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1lZjU3NDIzYmFkZGUxOTllZGYzZWQ2ZWZmMmEwN2Y4ZGM4ZjljYzYyMDE1NjgxOTQ2NDMyMDk3NTM0ZWEyMGU3JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.VgnEhwNunrl5nVFJKq0jgTzQ4JzsMQNBvn3qyj4N7F4)
System Info
Used Package Manager
pnpm
Validations
The text was updated successfully, but these errors were encountered: