From edf3c5eaf772584013cb728855ff124584db2094 Mon Sep 17 00:00:00 2001
From: Barney Carroll <barney.carroll@gmail.com>
Date: Thu, 24 Nov 2016 12:25:00 +0000
Subject: [PATCH] Tests for contenteditable trust, including failing test for
 #1421

---
 render/tests/test-attributes.js | 58 +++++++++++++++++++++++++++++++--
 1 file changed, 56 insertions(+), 2 deletions(-)

diff --git a/render/tests/test-attributes.js b/render/tests/test-attributes.js
index 6df82eaf..73cbd685 100644
--- a/render/tests/test-attributes.js
+++ b/render/tests/test-attributes.js
@@ -79,9 +79,9 @@ o.spec("attributes", function() {
 	o.spec("canvas width and height", function() {
 		o("uses attribute API", function() {
 			var canvas = {tag: "canvas", attrs: {width: "100%"}}
-			
+
 			render(root, canvas)
-			
+
 			o(canvas.dom.attributes["width"].nodeValue).equals("100%")
 			o(canvas.dom.width).equals(100)
 		})
@@ -95,4 +95,58 @@ o.spec("attributes", function() {
 			o(a.dom.attributes["class"].nodeValue).equals("test")
 		})
 	})
+	o.spec("contenteditable throws on untrusted children", function() {
+		o("including text nodes", function() {
+			var div = {tag: "div", attrs: {contenteditable: true}, text: ''}
+			var succeeded = false
+
+			try {
+				render(root, div)
+
+				succeeded = true
+			}
+			catch(e){}
+
+			o(succeeded).equals(false)
+		})
+		o("including elements", function() {
+			var div = {tag: "div", attrs: {contenteditable: true}, children: [{tag: "script", attrs: {src: "http://evil.com"}}]}
+			var succeeded = false
+
+			try {
+				render(root, div)
+
+				succeeded = true
+			}
+			catch(e){}
+
+			o(succeeded).equals(false)
+		})
+		o("tolerating empty children", function() {
+			var div = {tag: "div", attrs: {contenteditable: true}, children: []}
+			var succeeded = false
+
+			try {
+				render(root, div)
+
+				succeeded = true
+			}
+			catch(e){}
+
+			o(succeeded).equals(true)
+		})
+		o("tolerating trusted content", function() {
+			var div = {tag: "div", attrs: {contenteditable: true}, children: [{tag: "<", children: "<a></a>"}]}
+			var succeeded = false
+
+			try {
+				render(root, div)
+
+				succeeded = true
+			}
+			catch(e){}
+
+			o(succeeded).equals(true)
+		})
+	})
 })