Commit | Line | Data |
---|---|---|
8b38c21f A |
1 | /** |
2 | * @fileoverview FILL THIS IN | |
3 | * | |
4 | * @author akiya.mizukoshi@gmail.com (Akiyah) | |
5 | */ | |
6 | var pluginsLegendTestCase = TestCase("plugins-legend"); | |
7 | ||
8 | pluginsLegendTestCase.prototype.setUp = function() { | |
9 | document.body.innerHTML = "<div id='graph'></div>"; | |
10 | }; | |
11 | ||
12 | pluginsLegendTestCase.prototype.tearDown = function() { | |
13 | }; | |
14 | ||
15 | pluginsLegendTestCase.prototype.testLegendEscape = function() { | |
16 | var opts = { | |
17 | width: 480, | |
18 | height: 320 | |
19 | }; | |
20 | var data = "X,<script>alert('XSS')</script>\n" + | |
21 | "0,-1\n" + | |
22 | "1,0\n" + | |
23 | "2,1\n" + | |
24 | "3,0\n" | |
25 | ; | |
26 | ||
27 | var graph = document.getElementById("graph"); | |
28 | var g = new Dygraph(graph, data, opts); | |
29 | ||
30 | var legendPlugin = new Dygraph.Plugins.Legend(); | |
31 | legendPlugin.activate(g); | |
32 | var e = { | |
33 | selectedX: 'selectedX', | |
34 | selectedPoints: [{ | |
35 | canvasy: 100, | |
36 | name: "<script>alert('XSS')</script>", | |
37 | yval: 10, | |
38 | }], | |
39 | dygraph: g | |
40 | } | |
41 | legendPlugin.select(e); | |
42 | ||
43 | var legendSpan = $(legendPlugin.legend_div_).find("span b span"); | |
44 | assertEquals("<script>alert('XSS')</script>", legendSpan.html()); | |
45 | }; | |
46 |