diff --git a/test/sanitizer_test.rb b/test/sanitizer_test.rb index 1133e56..c728f47 100644 --- a/test/sanitizer_test.rb +++ b/test/sanitizer_test.rb @@ -846,16 +846,59 @@ def test_mediatype_image_svg_xml_disallowed assert_equal(expected, actual) end - def test_mediatype_other_disallowed - input = 'foo' - expected = "foo" - actual = safe_list_sanitize(input) - assert_equal(expected, actual) + # Loofah 2.25.2 changed the behavior of `data:` URLs with invalid mediatypes to be treated as + # text/plain, which is an allowed media type. So we need to adjust the test accordingly. + if Gem::Version.new(Loofah::VERSION) <= Gem::Version.new("2.25.1") + def test_mediatype_other_disallowed + input = 'foo' + expected = "foo" + actual = safe_list_sanitize(input) + assert_equal(expected, actual) - input = 'foo' - expected = "foo" - actual = safe_list_sanitize(input) - assert_equal(expected, actual) + input = 'foo' + expected = "foo" + actual = safe_list_sanitize(input) + assert_equal(expected, actual) + end + else + def test_mediatype_other_disallowed + input = 'foo' + expected = "foo" + actual = safe_list_sanitize(input) + assert_equal(expected, actual) + + input = 'foo' + expected = "foo" + actual = safe_list_sanitize(input) + assert_equal(expected, actual) + end + + def test_mediatype_missing_treated_as_text_plain + # https://www.rfc-editor.org/rfc/rfc2397.html and https://fetch.spec.whatwg.org/#data-urls + # state browsers should treat this as text/plain, so we can allow it. + input = 'foo' + expected = input + actual = safe_list_sanitize(input) + assert_equal(expected, actual) + + input = 'foo' + expected = input + actual = safe_list_sanitize(input) + assert_equal(expected, actual) + end + + def test_mediatype_invalid_treated_as_text_plain + # https://fetch.spec.whatwg.org/#data-urls states browsers should treat this as text/plain, so we can allow it. + input = 'foo' + expected = input + actual = safe_list_sanitize(input) + assert_equal(expected, actual) + + input = 'foo' + expected = input + actual = safe_list_sanitize(input) + assert_equal(expected, actual) + end end def test_scrubbing_svg_attr_values_that_allow_ref