mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-29 01:52:38 +09:00
Navigate explicitly in custom_styles XSS system test
The test relied on the post-login landing page implicitly, so the custom_styles <link> coverage could silently evaporate if that landing changes. Visit root_url explicitly (matching the writebook sibling) to pin the page under test. Assertions are unchanged and still non-vacuous.
This commit is contained in:
@@ -12,6 +12,11 @@ class CustomStylesXssTest < ApplicationSystemTestCase
|
||||
end
|
||||
|
||||
test "custom styles payload loads as a stylesheet and never executes" do
|
||||
# Navigate to the page under test explicitly (matching the writebook
|
||||
# sibling) rather than leaning on the post-login landing page — otherwise
|
||||
# this coverage could silently evaporate if that landing changes.
|
||||
visit root_url
|
||||
|
||||
# (a) custom styles arrive via an external stylesheet link, not inline markup
|
||||
assert_selector "link[rel='stylesheet'][href*='custom_styles']", visible: false
|
||||
|
||||
|
||||
Reference in New Issue
Block a user