added the ability to add safe html tags to input (i.e., images)

[selectricity] / test / functional / quickvote_controller_test.rb

diff --git a/test/functional/quickvote_controller_test.rb b/test/functional/quickvote_controller_test.rb
index 60ddb1b86f036e66362074f755914f90dc9cfa72..e116c0d7ada00a5335eb7044eca262dd6f350c4e 100644 (file)
--- a/test/functional/quickvote_controller_test.rb
+++ b/test/functional/quickvote_controller_test.rb
@@ -115,24 +115,40 @@ class QuickvoteControllerTest < Test::Unit::TestCase
     post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }
     assert_redirected_to :controller => 'quickvote', :ident => 'variable'
   end
     post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }
     assert_redirected_to :controller => 'quickvote', :ident => 'variable'
   end

+

   def test_display_tainted_quickvote
   def test_display_tainted_quickvote

+    # create quickvote with tainted data

     test_create_quickvote
     qv=QuickVote.ident_to_quickvote('variable')
     qv.description="<object>foo</object>"
     test_create_quickvote
     qv=QuickVote.ident_to_quickvote('variable')
     qv.description="<object>foo</object>"

-    qv.candidate_names = ["<object>foo", "bar<object>", "<foobar>"]
+    qv.candidate_names = ["<object>foo", "bar<object>", "<foobar>",
+                          '<img src="foo" alt="bar" />']

     qv.save!
     qv.save!

+
+    # display the vote/index page and check for bad tags and the ability
+    # to make an image tag

     get :index, { 'ident' => 'variable' }
     assert_response :success
     assert_no_tag :tag => "object"
     assert_no_tag :tag => "foobar"
     get :index, { 'ident' => 'variable' }
     assert_response :success
     assert_no_tag :tag => "object"
     assert_no_tag :tag => "foobar"

+    assert_tag :tag => "img",
+               :parent => { :tag => "li", :attributes => { :class => "moveable" } }
+
+    # actually vote

     votes = QuickVote.ident_to_quickvote('variable').candidates.collect { |c| c.id}
     post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }
     votes = QuickVote.ident_to_quickvote('variable').candidates.collect { |c| c.id}
     post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }

+
+    # check for bad/good tags

     assert_template('quickvote/thanks')
     assert_no_tag :tag => "object"
     assert_no_tag :tag => "foobar"
     assert_template('quickvote/thanks')
     assert_no_tag :tag => "object"
     assert_no_tag :tag => "foobar"

+    assert_tag :tag => "img", :parent => { :tag => "li" }
+
+    # get the results page and check for good/bad tags

     get :results, { 'ident' => 'variable' }
     assert_response :success
     assert_no_tag :tag => "object"
     assert_no_tag :tag => "foobar"
     get :results, { 'ident' => 'variable' }
     assert_response :success
     assert_no_tag :tag => "object"
     assert_no_tag :tag => "foobar"

+    assert_tag :tag => "img", :parent => { :tag => "li" }

   end
 end
   end
 end