提交 fa40239c 编写于 作者: J Justin Collins

Add test for `model.attribute.to_i` in XSS

上级 b8f9a415
......@@ -3,3 +3,7 @@
<%= request.env[:QUERY_STRING].to_i %>
<%= out @id %>
<%= User.current.age.to_i %>
<%= out Account.current.number.to_i %>
......@@ -815,4 +815,13 @@ class Rails2Tests < Test::Unit::TestCase
:confidence => 0,
:file => /test_to_i\.html\.erb/
end
def test_xss_with_model_attribute_to_i
assert_no_warning :type => :template,
:warning_type => "Cross Site Scripting",
:line => 7,
:message => /^Unescaped\ model\ attribute/,
:confidence => 1,
:file => /test_to_i\.html\.erb/
end
end
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册