forked from rails/rails_xss
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathform_options_helper_test.rb
40 lines (30 loc) · 1.68 KB
/
form_options_helper_test.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
require 'test_helper'
class FormOptionsHelperTest < ActionView::TestCase
Continent = Struct.new(:continent_name, :countries)
Country = Struct.new(:country_id, :country_name)
def test_option_groups_from_collection_for_select_returns_html_safe_string
assert option_groups_from_collection_for_select(dummy_continents, "countries", "continent_name", "country_id", "country_name", "dk").html_safe?
end
def test_option_groups_from_collection_for_select_escapes_unsafe
option_groups_from_collection_for_select_result = option_groups_from_collection_for_select(dummy_continents, "countries", "continent_name", "country_id", "country_name", "dk")
assert !option_groups_from_collection_for_select_result.match(/<Africa>/)
assert option_groups_from_collection_for_select_result.match(/<Africa>/)
end
def test_grouped_options_for_select_returns_html_safe_string
assert grouped_options_for_select([["Hats", ["Baseball Cap","Cowboy Hat"]]]).html_safe?
end
def test_grouped_options_for_select_prompt_is_escaped
grouped_options_result = grouped_options_for_select(grouped_options_sample_data, 'Europe', 'Some unescaped <script>text.</script>')
assert !grouped_options_result.match(/<script>/)
assert grouped_options_result.match(/<script>/)
end
private
def dummy_continents
[ Continent.new("<Africa>", [Country.new("<sa>", "<South Africa>"), Country.new("so", "Somalia")] ),
Continent.new("Europe", [Country.new("dk", "Denmark"), Country.new("ie", "Ireland")] ) ]
end
def grouped_options_sample_data
[ ['North America', [['United States','US'],'Canada']],
['Europe', ['Denmark','Germany','France']]]
end
end