auto_tests/tests/plugins_legend.js

   1 /**
   2  * @fileoverview FILL THIS IN
   3  *
   4  * @author akiya.mizukoshi@gmail.com (Akiyah)
   5  */
   6 var pluginsLegendTestCase = TestCase("plugins-legend");
   7
   8 pluginsLegendTestCase.prototype.setUp = function() {
   9   document.body.innerHTML = "<div id='graph'></div>";
  10 };
  11
  12 pluginsLegendTestCase.prototype.tearDown = function() {
  13 };
  14
  15 pluginsLegendTestCase.prototype.testLegendEscape = function() {
  16   var opts = {
  17     width: 480,
  18     height: 320
  19   };
  20   var data = "X,<script>alert('XSS')</script>\n" +
  21       "0,-1\n" +
  22       "1,0\n" +
  23       "2,1\n" +
  24       "3,0\n"
  25   ;
  26
  27   var graph = document.getElementById("graph");
  28   var g = new Dygraph(graph, data, opts);
  29
  30   var legendPlugin = new Dygraph.Plugins.Legend();
  31   legendPlugin.activate(g);
  32   var e = {
  33     selectedX: 'selectedX',
  34     selectedPoints: [{
  35       canvasy: 100,
  36       name: "<script>alert('XSS')</script>",
  37       yval: 10,
  38     }],
  39     dygraph: g
  40   }
  41   legendPlugin.select(e);
  42
  43   var legendSpan = $(legendPlugin.legend_div_).find("span b span");
  44   assertEquals("&lt;script&gt;alert('XSS')&lt;/script&gt;", legendSpan.html());
  45 };
  46