|
@@ -166,13 +166,18 @@ def test_move(screen: Screen):
|
|
|
def test_xss(screen: Screen):
|
|
|
ui.label('</script><script>alert(1)</script>')
|
|
|
ui.label('<b>Bold 1</b>')
|
|
|
- ui.button('Button 1', on_click=lambda: ui.label('</script><script>alert(2)</script>'))
|
|
|
- ui.button('Button 2', on_click=lambda: ui.label('<b>Bold 2</b>'))
|
|
|
+ ui.label('multi\nline 1')
|
|
|
+ ui.button('Button', on_click=lambda: (
|
|
|
+ ui.label('</script><script>alert(2)</script>'),
|
|
|
+ ui.label('<b>Bold 2</b>'),
|
|
|
+ ui.label('multi\nline 2'),
|
|
|
+ ))
|
|
|
|
|
|
screen.open('/')
|
|
|
- screen.click('Button 1')
|
|
|
- screen.click('Button 2')
|
|
|
+ screen.click('Button')
|
|
|
screen.should_contain('</script><script>alert(1)</script>')
|
|
|
screen.should_contain('</script><script>alert(2)</script>')
|
|
|
screen.should_contain('<b>Bold 1</b>')
|
|
|
screen.should_contain('<b>Bold 2</b>')
|
|
|
+ screen.should_contain('multi\nline 1')
|
|
|
+ screen.should_contain('multi\nline 2')
|