update testcase to cover result from esapi and owasp encoder library that are both valid

michaeloffner · michaeloffner · commit 78f342858e8c · 2026-01-09T15:40:34.000+01:00
diff --git a/test/functions/EncodeForXMLAttribute.cfc b/test/functions/EncodeForXMLAttribute.cfc
@@ -1,14 +1,14 @@
-component extends="org.lucee.cfml.test.LuceeTestCase" labels="esapi,xml"{
+component extends="org.lucee.cfml.test.LuceeTestCase" labels="esapi"{
 	function run( testResults , testBox ) {
 		describe( "test case for EncodeForXMLAttribute", function() {
 			it(title = "Checking with EncodeForXMLAttribute", body = function( currentSpec ) {
 				var enc=EncodeForXMLAttribute('<script>');
-				assertEquals('&##x3c;script&##x3e;',enc);
+				assertEquals('&lt;script>',enc);
 			});
 
 			it(title = "Checking with EncodeForXMLAttributeMember", body = function( currentSpec ) {
 				var enc='<script>'.EncodeForXMLAttribute();
-				assertEquals('&##x3c;script&##x3e;',enc);
+				assertEquals('&lt;script>',enc);
 			});
 		});	
 	}
diff --git a/test/functions/SanitizeHtml.cfc b/test/functions/SanitizeHtml.cfc
@@ -4,9 +4,11 @@ component extends="org.lucee.cfml.test.LuceeTestCase"{
         describe( title = "Testcase for sanitizeHTML function", body = function() {
             it( title = "checking sanitizeHTML() function", body = function( currentSpec ) {
                 var html = '<!DOCTYPE html><html><body><h2>HTML Forms</h2><form action="/action_page.cfm"><label for="fname">First name:</label><br><input type="text" id="fname" name="fname"value="Pothys"><br></body></html>';
+                var res=SanitizeHtml(html);
 
-                expect(SanitizeHtml(html)).toBe('<h2>HTML Forms</h2>First name:<br /><br />');
-                expect(html.SanitizeHtml()).toBe('<h2>HTML Forms</h2>First name:<br /><br />'); // member function
+                // cover result from esapi and owasp encoder library that are both valid
+				var isValid = res=='<h2>HTML Forms</h2>First name:<br /><br />' || res=='<h2>HTML Forms</h2>First name:<br><br>';
+                expect(isValid).toBe(true);
             });
         });
     }
