diff --git a/package.json b/package.json index 6ff63422..eeac00a5 100644 --- a/package.json +++ b/package.json @@ -32,7 +32,7 @@ "test": "npm run lint-errors && npm run just-test-in-node", "test-in-node": "npm run lint-errors && npm run just-test-in-node", "just-test": "karma start --config karma.conf.js", - "just-test-in-node": "mocha --recursive --compilers js:babel-core/register test/core test/components test/bugs test/swagger-ui-dist-package", + "just-test-in-node": "mocha --recursive --compilers js:babel-core/register test/core test/components test/bugs test/swagger-ui-dist-package test/xss", "test-e2e": "sleep 3 && nightwatch test/e2e/scenarios/ --config test/e2e/nightwatch.json", "e2e-initial-render": "nightwatch test/e2e/scenarios/ --config test/e2e/nightwatch.json --group initial-render", "mock-api": "json-server --watch test/e2e/db.json --port 3204", diff --git a/src/core/plugins/oas3/wrap-components/markdown.js b/src/core/plugins/oas3/wrap-components/markdown.js index 103a2801..2d7f27e7 100644 --- a/src/core/plugins/oas3/wrap-components/markdown.js +++ b/src/core/plugins/oas3/wrap-components/markdown.js @@ -1,10 +1,11 @@ import React from "react" +import PropTypes from "prop-types" import ReactMarkdown from "react-markdown" import { Parser, HtmlRenderer } from "commonmark" import { OAS3ComponentWrapFactory } from "../helpers" import { sanitizer } from "core/components/providers/markdown" -export default OAS3ComponentWrapFactory(({ source }) => { +export const Markdown = ({ source }) => { if ( source ) { const parser = new Parser() const writer = new HtmlRenderer() @@ -23,4 +24,9 @@ export default OAS3ComponentWrapFactory(({ source }) => { ) } return null -}) \ No newline at end of file +} +Markdown.propTypes = { + source: PropTypes.string +} + +export default OAS3ComponentWrapFactory(Markdown) \ No newline at end of file diff --git a/test/xss/markdown-script-sanitization.js b/test/xss/markdown-script-sanitization.js new file mode 100644 index 00000000..4a353316 --- /dev/null +++ b/test/xss/markdown-script-sanitization.js @@ -0,0 +1,24 @@ +/* eslint-env mocha */ +import React from "react" +import expect from "expect" +import { render } from "enzyme" +import Markdown from "components/providers/markdown" +import { Markdown as OAS3Markdown } from "corePlugins/oas3/wrap-components/markdown.js" + +describe.only("Markdown Script Sanitization", function() { + describe("Swagger 2.0", function() { + it("sanitizes ` + const el = render() + expect(el.html()).toEqual(`

script

\n
`) + }) + }) + + describe("OAS 3", function() { + it("sanitizes ` + const el = render() + expect(el.html()).toEqual(`

script

`) + }) + }) +})