pjfanning commented on code in PR #1455:
URL: https://github.com/apache/poi/pull/1455#discussion_r4349617798
##########
poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToHtmlConverter.java:
##########
@@ -180,6 +182,41 @@ void testFontNameInStylesheet() throws Exception {
}
}
+ @Test
+ void testScriptHyperlink() throws Exception {
+ // the target of a HYPERLINK field is copied into the href of the
link, so a
+ // javascript: target ran script in the page when the link was followed
+ try (POIFSFileSystem fs = new
POIFSFileSystem(SAMPLES.openResourceAsStream("hyperlink.doc"))) {
+ replaceText(fs, "http://testuri.org/";, "javascript:alert(1)");
+
+ try (HWPFDocument hwpfDocument = new HWPFDocument(fs)) {
+ String result = getHtmlText(hwpfDocument, true);
+ assertNotContains(result, "javascript:");
+ assertContains(result, "<span class=\"s1\">Hyperlink
text</span>");
+ }
+ }
+ }
+
+ @Test
+ void testIsSafeHyperlink() {
+ assertTrue(WordToHtmlUtils.isSafeHyperlink("http://testuri.org/";));
Review Comment:
I'd prefer if ham crest assertions were used - the error reports if these
test fail are going to be illegible. I'll fix this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
