Merge pull request #9 from digipost/add-cve-test

digipost · Jan 11, 2022 · 6ced9c4 · 6ced9c4
2 parents 8fb3642 + 7410a4a
commit 6ced9c4
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/test/java/no/digipost/sanitizing/internal/RichHtmlValidatorTest.java b/src/test/java/no/digipost/sanitizing/internal/RichHtmlValidatorTest.java
@@ -199,6 +199,12 @@ public void skal_tillate_maillenker_uten_target_blank() {
         assertEquals("<a href=\"http://example.org\" target=\"_blank\" rel=\"nofollow noreferrer noopener\">Clicky clicky</a>", validatedHtml);
     }
 
+    // https://nvd.nist.gov/vuln/detail/CVE-2021-42575
+    @Test
+    public void skal_feile_CVE_2021_42575() {
+        assertInvalid("<select><option><style><script>alert(1)</script></style></option></select>\n");
+    }
+
     private void assertValid(String html) {
         try {
             validator.sanitize(html, ApiHtmlValidatorPolicy.V2_VALIDATE_HTML_AND_CSS_POLICY);