X-Git-Url: https://adrianiainlam.tk/git/?a=blobdiff_plain;ds=sidebyside;f=auto_tests%2Ftests%2Fplugins_legend.js;fp=auto_tests%2Ftests%2Fplugins_legend.js;h=3288329fc60c1169be9782559b44847193334d50;hb=8b38c21f85cdf96126ed536777dfe61b30096bcf;hp=0000000000000000000000000000000000000000;hpb=4d28164e5ad05d7221b332b5c26a2ef4d70125dd;p=dygraphs.git

diff --git a/auto_tests/tests/plugins_legend.js b/auto_tests/tests/plugins_legend.js
new file mode 100644
index 0000000..3288329
--- /dev/null
+++ b/auto_tests/tests/plugins_legend.js
@@ -0,0 +1,46 @@
+/**
+ * @fileoverview FILL THIS IN
+ *
+ * @author akiya.mizukoshi@gmail.com (Akiyah)
+ */
+var pluginsLegendTestCase = TestCase("plugins-legend");
+
+pluginsLegendTestCase.prototype.setUp = function() {
+  document.body.innerHTML = "<div id='graph'></div>";
+};
+
+pluginsLegendTestCase.prototype.tearDown = function() {
+};
+
+pluginsLegendTestCase.prototype.testLegendEscape = function() {
+  var opts = {
+    width: 480,
+    height: 320
+  };
+  var data = "X,<script>alert('XSS')</script>\n" +
+      "0,-1\n" +
+      "1,0\n" +
+      "2,1\n" +
+      "3,0\n"
+  ;
+
+  var graph = document.getElementById("graph");
+  var g = new Dygraph(graph, data, opts);
+
+  var legendPlugin = new Dygraph.Plugins.Legend();
+  legendPlugin.activate(g);
+  var e = {
+    selectedX: 'selectedX',
+    selectedPoints: [{
+      canvasy: 100,
+      name: "<script>alert('XSS')</script>",
+      yval: 10,
+    }],
+    dygraph: g
+  }
+  legendPlugin.select(e);
+
+  var legendSpan = $(legendPlugin.legend_div_).find("span b span");
+  assertEquals("&lt;script&gt;alert('XSS')&lt;/script&gt;", legendSpan.html());
+};
+