Skip to content

Commit

Permalink
Add new test for Alpine.js attribute escaping
Browse files Browse the repository at this point in the history
This commit introduces a new test case to ensure proper HTML escaping for Alpine.js attributes in templates. The test checks that potentially harmful JavaScript within `x-init` attributes is correctly escaped to prevent XSS attacks, similar to the existing test for `onclick` attributes.
  • Loading branch information
tschuehly committed Oct 25, 2024
1 parent c3c3e46 commit 909c9ad
Showing 1 changed file with 10 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -927,9 +927,17 @@ void script4() {
void onMethods() {
codeResolver.givenCode("template.jte", "@param String userName\n\n<span onclick=\"showName('${userName}')\">Click me</span>");

templateEngine.render("template.jte", "'); alert('xss", output);
templateEngine.render("template.jte", "'\n); alert('xss", output);

assertThat(output.toString()).isEqualTo("\n<span onclick=\"showName('\\x27); alert(\\x27xss')\">Click me</span>");
assertThat(output.toString()).isEqualTo("\n<span onclick=\"showName('\\x27\\n); alert(\\x27xss')\">Click me</span>");
}
@Test
void alpineJs() {
codeResolver.givenCode("template.jte", "@param String userName\n\n<span x-init=\"showName('${userName}')\">Click me</span>");

templateEngine.render("template.jte", "\n'); alert('xss", output);

assertThat(output.toString()).isEqualTo("\n<span x-init=\"showName('\\x27\\n); alert(\\x27xss')\">Click me</span>");
}

@Test
Expand Down

0 comments on commit 909c9ad

Please sign in to comment.