Google Git
Sign in
webkit / WebKit / 15e4da4b5ce83fcfe6de6863df44c60571019d5f / . / LayoutTests / fast / innerHTML / innerHTML-special-elements.html
blob: 48512f79f830ac4f5a7be5271885323d1d84b235 [file] [log] [blame]
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body>
<div id="hidden" style="visibility: hidden">
<script id="script">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</script>
<style id="style">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</style>
<textarea id="textarea">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</textarea>
<xmp id="xmp">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</xmp>
</div>
<script>
description("Tests that accessing the innerHTML property of a text node encodes harmful entities which can result in cross site scripting.");
var tests = [ ['innerHTML("script")' , '"/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */"'],
['innerHTML("style")' , '"/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */"'],
['innerHTML("textarea")', '"/*\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt; */"'],
['innerHTML("xmp")' , '"/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */"'],
['outerHTML("script")' , '"<script id=\\"script\\">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */<\/script>"'],
['outerHTML("style")' , '"<style id=\\"style\\">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */<\/style>"'],
['outerHTML("textarea")', '"<textarea id=\\"textarea\\">/*\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt; */<\/textarea>"'],
['outerHTML("xmp")' , '"<xmp id=\\"xmp\\">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */<\/xmp>"'],
];
function innerHTML(textnode) {
return document.getElementById(textnode).innerHTML;
}
function outerHTML(textnode) {
return document.getElementById(textnode).outerHTML;
}
for (var i in tests) {
shouldBe(tests[i][0], tests[i][1]);
}
</script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>