forked from OWASP/java-html-sanitizer
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathOptgroupBugTest.java
More file actions
27 lines (22 loc) · 972 Bytes
/
OptgroupBugTest.java
File metadata and controls
27 lines (22 loc) · 972 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
package org.owasp.html;
import org.junit.Test;
import static org.junit.Assert.assertEquals;
public class OptgroupBugTest {
/**
* Test that optgroup elements inside select are not corrupted with extra select tags.
*
* Before fix: <select><optgroup><select><option></option></select></optgroup></select>
* After fix: <select><optgroup><option></option></optgroup></select>
*/
@Test
public void testOptgroupInsideSelectDoesNotAddExtraSelectTags() {
PolicyFactory factory = new HtmlPolicyBuilder()
.allowElements("select", "optgroup", "option")
.allowAttributes("label").globally()
.toFactory();
String input = "<select><optgroup label=\"mygroup\"><option>My option</option></optgroup></select>";
String result = factory.sanitize(input);
// The key assertion: no extra select tags should be inserted
assertEquals(input, result);
}
}