File tree 2 files changed +1
-13
lines changed
app/views/rails_admin/main
2 files changed +1
-13
lines changed Original file line number Diff line number Diff line change 103
103
%td .other.left = link_to " ..." , @other_left_link, class: 'pjax'
104
104
- properties.map{ |property| property.bind(:object, object) }.each do |property|
105
105
- value = property.pretty_value
106
- %td {class: "#{property.css_class} #{property.type_css_class}", title: value}= value
106
+ %td {class: "#{property.css_class} #{property.type_css_class}", title: strip_tags( value.to_s) }= value
107
107
- if @other_right_link ||= other_right && index_path(params.merge(set: (params[:set].to_i + 1)))
108
108
%td .other.right = link_to " ..." , @other_right_link, class: 'pjax'
109
109
- unless frozen_columns
Original file line number Diff line number Diff line change 654
654
visit index_path ( model_name : 'team' )
655
655
expect ( find ( 'tbody tr:nth-child(1) td:nth-child(4)' ) ) . to have_content ( @players . sort_by ( &:id ) . collect ( &:name ) . join ( ', ' ) )
656
656
end
657
-
658
- it 'does not allow XSS for title attribute' do
659
- RailsAdmin . config Team do
660
- list do
661
- field :name
662
- end
663
- end
664
- @team = FactoryBot . create :team , name : '" onclick="alert()" "'
665
- visit index_path ( model_name : 'team' )
666
- expect ( find ( 'tbody tr:nth-child(1) td:nth-child(2)' ) [ 'onclick' ] ) . to be_nil
667
- expect ( find ( 'tbody tr:nth-child(1) td:nth-child(2)' ) [ 'title' ] ) . to eq '" onclick="alert()" "'
668
- end
669
657
end
670
658
671
659
context 'without pagination' do
You can’t perform that action at this time.
0 commit comments