From 84ad886114f7c4b41278b2cf85a9d802fbb0cdb1 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 8 Aug 2026 19:42:29 -0700 Subject: [PATCH] Navigate explicitly in custom_styles XSS system test The test relied on the post-login landing page implicitly, so the custom_styles coverage could silently evaporate if that landing changes. Visit root_url explicitly (matching the writebook sibling) to pin the page under test. Assertions are unchanged and still non-vacuous. --- test/system/custom_styles_xss_test.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/test/system/custom_styles_xss_test.rb b/test/system/custom_styles_xss_test.rb index 2a70875..9c0a4cf 100644 --- a/test/system/custom_styles_xss_test.rb +++ b/test/system/custom_styles_xss_test.rb @@ -12,6 +12,11 @@ class CustomStylesXssTest < ApplicationSystemTestCase end test "custom styles payload loads as a stylesheet and never executes" do + # Navigate to the page under test explicitly (matching the writebook + # sibling) rather than leaning on the post-login landing page — otherwise + # this coverage could silently evaporate if that landing changes. + visit root_url + # (a) custom styles arrive via an external stylesheet link, not inline markup assert_selector "link[rel='stylesheet'][href*='custom_styles']", visible: false