chore(rubocop): giganto rubocop commit.

muahahahah
This commit is contained in:
Joseph Mastey
2017-12-05 18:46:21 -06:00
parent 284cd8811c
commit 9902345291
120 changed files with 743 additions and 635 deletions
+10 -9
View File
@@ -1,30 +1,31 @@
require 'spec_helper'
# frozen_string_literal: true
require "spec_helper"
feature 'xss' do
feature "xss" do
before do
UserFixture.reset_all_users
@normal_user = UserFixture.normal_user
end
scenario "attack\nTutorial: https://github.com/OWASP/railsgoat/wiki/A3-Cross-Site-Scripting", :js => true do
scenario "attack\nTutorial: https://github.com/OWASP/railsgoat/wiki/A3-Cross-Site-Scripting", js: true do
login @normal_user
visit "/users/#{@normal_user.user_id}/account_settings"
within('#account_edit') do
fill_in 'First name', :with => "<script>$(function() { $('div input.btn').val('RailsGoat h4x0r3d') } )</script>"
within("#account_edit") do
fill_in "First name", with: "<script>$(function() { $('div input.btn').val('RailsGoat h4x0r3d') } )</script>"
# password gets screwed up if you don't re-submit - need to fix
fill_in 'user_password', :with => @normal_user.clear_password
fill_in 'user_password_confirmation', :with => @normal_user.clear_password
fill_in "user_password", with: @normal_user.clear_password
fill_in "user_password_confirmation", with: @normal_user.clear_password
end
click_on 'Submit'
click_on "Submit"
sleep(1)
visit "/users/#{@normal_user.user_id}/account_settings"
pending if verifying_fixed?
expect(find('#submit_button').value).to eq('RailsGoat h4x0r3d')
expect(find("#submit_button").value).to eq("RailsGoat h4x0r3d")
# might be nice to demonstrate posting cookie contents or somesuch, but
# this at least shows the vulnerability still exists.