Read about our upcoming Code of Conduct on this issue

issue_detail_spec.rb 1.62 KB
Newer Older
1
2
# frozen_string_literal: true

3
require 'spec_helper'
4

5
describe 'Issue Detail', :js do
6
7
8
  let(:user)     { create(:user) }
  let(:project)  { create(:project, :public) }
  let(:issue)    { create(:issue, project: project, author: user) }
9
10
11
12
13
14
15
16
17
18
19
20
21
22

  context 'when user displays the issue' do
    before do
      visit project_issue_path(project, issue)
      wait_for_requests
    end

    it 'shows the issue' do
      page.within('.issuable-details') do
        expect(find('h2')).to have_content(issue.title)
      end
    end
  end

23
24
25
  context 'when issue description has xss snippet' do
    before do
      issue.update!(description: '![xss" onload=alert(1);//](a)')
26

27
28
29
30
      sign_in(user)
      visit project_issue_path(project, issue)
    end

31
    it 'encodes the description to prevent xss issues' do
32
      page.within('.issuable-details .detail-page-description') do
33
34
        image = find('img.js-lazy-loaded')

35
        expect(page).to have_selector('img', count: 1)
36
37
        expect(image['onerror']).to be_nil
        expect(image['src']).to end_with('/a')
38
39
40
41
      end
    end
  end

42
43
44
45
46
47
  context 'when edited by a user who is later deleted' do
    before do
      sign_in(user)
      visit project_issue_path(project, issue)
      wait_for_requests

48
      page.find('.js-issuable-edit').click
49
      fill_in 'issuable-title', with: 'issue title'
50
      click_button 'Save'
51
      wait_for_requests
52

53
      Users::DestroyService.new(user).execute(user)
54
55
56
57
58
59
60
61
62
63
64

      visit project_issue_path(project, issue)
    end

    it 'shows the issue' do
      page.within('.issuable-details') do
        expect(find('h2')).to have_content(issue.reload.title)
      end
    end
  end
end