diff --git a/spec/invidious/comments_content_spec.cr b/spec/invidious/comments_content_spec.cr new file mode 100644 index 00000000..66291537 --- /dev/null +++ b/spec/invidious/comments_content_spec.cr @@ -0,0 +1,29 @@ +require "../spec_helper" + +Spectator.describe "parse_content" do + it "sanitizes raw run text for emoji alt attributes if accessibility label is missing" do + payload = JSON.parse(%({ + "runs": [ + { + "text": "", + "emoji": { + "image": { + "thumbnails": [ + { + "url": "http://example.com/image.jpg", + "width": 24, + "height": 24 + } + ] + } + } + } + ] + })) + + result = parse_content(payload) + expect(result).to contain("alt=\"<script>alert(1)</script>\"") + expect(result).to contain("title=\"<script>alert(1)</script>\"") + expect(result).to_not contain("