third_party/WebKit/LayoutTests/fast/innerHTML/innerHTML-special-elements.html

   1 <html>
   2 <head>
   3 <script src="../../resources/js-test.js"></script>
   4 </head>
   5 <body>
   6 <div id="hidden"  style="visibility: hidden">
   7 <script id="script">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</script>
   8 <style id="style">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</style>
   9 <textarea id="textarea">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</textarea>
  10 <xmp id="xmp">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;"'&<> */</xmp>
  11 </div>
  12 <script>
  13 description("Tests that accessing the innerHTML property of a text node encodes harmful entities which can result in cross site scripting.");
  14
  15 var tests = [ ['innerHTML("script")'  , '"/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */"'],
  16               ['innerHTML("style")'   , '"/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */"'],
  17               ['innerHTML("textarea")', '"/*\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt; */"'],
  18               ['innerHTML("xmp")'     , '"/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */"'],
  19               ['outerHTML("script")'  , '"<script id=\\"script\\">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */<\/script>"'],
  20               ['outerHTML("style")'   , '"<style id=\\"style\\">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */<\/style>"'],
  21               ['outerHTML("textarea")', '"<textarea id=\\"textarea\\">/*\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt;&nbsp;\\"\'&amp;&lt;&gt; */<\/textarea>"'],
  22               ['outerHTML("xmp")'     , '"<xmp id=\\"xmp\\">/*&quot;&apos;&amp;&lt;&gt;&nbsp;&#34;&#39;&#38;&#60;&#62;&#160;\\"\'&<> */<\/xmp>"'],
  23             ];
  24
  25 function innerHTML(textnode) {
  26     return document.getElementById(textnode).innerHTML;
  27 }
  28
  29 function outerHTML(textnode) {
  30     return document.getElementById(textnode).outerHTML;
  31 }
  32
  33 for (var i in tests) {
  34     shouldBe(tests[i][0], tests[i][1]);
  35 }
  36
  37 </script>
  38 </body>
  39 </html>