This is not a security issue because regular users are not allowed to insert FA icons anywhere in the app. Admins can insert icons via custom badges, but they do have the ability to create themes with JS.
40 lines
1.3 KiB
JavaScript
40 lines
1.3 KiB
JavaScript
import {
|
|
convertIconClass,
|
|
iconHTML,
|
|
iconNode,
|
|
} from "discourse-common/lib/icon-library";
|
|
import { module, test } from "qunit";
|
|
|
|
module("Unit | Utility | icon-library", function () {
|
|
test("return icon markup", function (assert) {
|
|
assert.ok(iconHTML("bars").indexOf('use xlink:href="#bars"') > -1);
|
|
|
|
const nodeIcon = iconNode("bars");
|
|
assert.equal(nodeIcon.tagName, "svg");
|
|
assert.equal(
|
|
nodeIcon.properties.attributes.class,
|
|
"fa d-icon d-icon-bars svg-icon svg-node"
|
|
);
|
|
});
|
|
|
|
test("convert icon names", function (assert) {
|
|
const fa5Icon = convertIconClass("fab fa-facebook");
|
|
assert.ok(iconHTML(fa5Icon).indexOf("fab-facebook") > -1, "FA 5 syntax");
|
|
|
|
const iconC = convertIconClass(" fab fa-facebook ");
|
|
assert.ok(iconHTML(iconC).indexOf(" ") === -1, "trims whitespace");
|
|
});
|
|
|
|
test("escape icon names, classes and titles", function (assert) {
|
|
const html = iconHTML("'<img src='x'>", {
|
|
translatedtitle: "'<script src='y'>",
|
|
label: "<iframe src='z'>",
|
|
class: "'<link href='w'>",
|
|
});
|
|
assert.ok(html.includes("'<img src='x'>"));
|
|
assert.ok(html.includes("'<script src='y'>"));
|
|
assert.ok(html.includes("<iframe src='z'>"));
|
|
assert.ok(html.includes("'<link href='w'>"));
|
|
});
|
|
});
|