search

alextiley / wdio-cucumber-json-reporter

Generates a JSON report for cucumber via webdriver.io
9 stars 2 forks source link

Bug: JavaScript script tags are not sanitized #2

Open alextiley opened 6 years ago

alextiley commented 6 years ago

Example feature:

Scenario Outline: I enter a script tag into a text input
    When I type "<phrase>" into the text field
    Examples:
      | phrase                           |
      | <script>alert('fail');</script>  |

Expected outcome: JSON output should not contain raw JavaScript Actual outcome: See JSON snippet below

...
{
  "keyword": "When ",
  "line": 183,
  "name": "I type \"<script>alert('fail');</script>\" into the destination search field",
  "id": "I type \"<script>alert('fail');</script>\" into the text field183",
  "tags": [],
  "uri": "/spec/functional/features/MyFeature.feature",
  "result": {
    "status": "passed",
    "duration": 185000000
  },
  "embeddings": []
},
...