showdown-xss-filter/test/test.js

XSS filter extension for showdown

var expect = require('expect.js'),
    filter = require('../showdown-xss-filter'),
    showdown = require('showdown');

// tests to ensure resolved issues are not re-introduced
describe('issues', function() {

  // https://github.com/VisionistInc/showdown-xss-filter/issues/4
  describe('#4: filters html generated by showdown rendering html', function() {

    var converter;

    beforeEach(function(done) {
      converter = new showdown.Converter({extensions: [filter]});
      done();
    });

    it("filters XSS attacks in markdown links", function(done) {
      var markdown = "[test](javascript:alert('xss'))";
      var converted = converter.makeHtml(markdown);

      expect(converted).to.eql('<p><a href>test</a></p>');
      done();
    });

    it("properly filters mixed markdown/html attack using blockquotes", function(done) {
      var markdown = '> hello <a name="n"\n> href="javascript:alert(\'xss\')">*you*</a>';
      var converted = converter.makeHtml(markdown);

      expect(converted).to.eql('<blockquote>\n  <p>hello <a href><em>you</em></a></p>\n</blockquote>');
      done();
    });
  });
});