Drop HTMLSanitizeEx and fix title sanitizing

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel
2020-06-24 16:33:59 +02:00
parent 0f489757f7
commit 83aa005faf
12 changed files with 40 additions and 17 deletions

View File

@@ -7,6 +7,7 @@ defmodule Mobilizon.GraphQL.API.ReportTest do
alias Mobilizon.Conversations.Comment
alias Mobilizon.Events.Event
alias Mobilizon.Reports.{Note, Report}
alias Mobilizon.Service.Formatter.HTML
alias Mobilizon.Users
alias Mobilizon.Users.User
@@ -92,7 +93,7 @@ defmodule Mobilizon.GraphQL.API.ReportTest do
_comment_2 = insert(:comment, actor: reported)
comment = "This is really not acceptable, remote admin I don't know"
encoded_comment = HtmlSanitizeEx.strip_tags(comment)
encoded_comment = HTML.strip_tags(comment)
assert {:ok, %Activity{} = flag_activity, _} =
Reports.report(%{

View File

@@ -193,7 +193,7 @@ defmodule Mobilizon.Web.Resolvers.EventTest do
)
end
test "create_event/3 creates an event and escapes title and description", %{
test "create_event/3 creates an event and escapes title", %{
conn: conn,
actor: actor,
user: user
@@ -214,7 +214,9 @@ defmodule Mobilizon.Web.Resolvers.EventTest do
)
assert res["errors"] == nil
assert res["data"]["createEvent"]["title"] == "My Event title"
assert res["data"]["createEvent"]["title"] ==
"My Event title <img src=\"http://placekitten.com/g/200/300\" onclick=\"alert('aaa')\" >"
assert res["data"]["createEvent"]["description"] ==
"<b>My description</b> <img src=\"http://placekitten.com/g/200/300\"/>"