Navigate explicitly in custom_styles XSS system test

The test relied on the post-login landing page implicitly, so the
custom_styles <link> coverage could silently evaporate if that landing
changes. Visit root_url explicitly (matching the writebook sibling) to pin
the page under test. Assertions are unchanged and still non-vacuous.
This commit is contained in:
Jeremy Daer
2026-08-08 19:42:29 -07:00
parent 2fd1483e16
commit 84ad886114
+5
View File
@@ -12,6 +12,11 @@ class CustomStylesXssTest < ApplicationSystemTestCase
end
test "custom styles payload loads as a stylesheet and never executes" do
# Navigate to the page under test explicitly (matching the writebook
# sibling) rather than leaning on the post-login landing page — otherwise
# this coverage could silently evaporate if that landing changes.
visit root_url
# (a) custom styles arrive via an external stylesheet link, not inline markup
assert_selector "link[rel='stylesheet'][href*='custom_styles']", visible: false