diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js index e1f05b6e6..842eab36f 100644 --- a/cypress/integration/other/xss.spec.js +++ b/cypress/integration/other/xss.spec.js @@ -53,5 +53,15 @@ describe('XSS', () => { cy.wait(1000); cy.get('#the-malware').should('not.exist'); }) + it('should not allow maniplulating htmlLabels into a false positive', () => { + cy.visit('http://localhost:9000/xss4.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) + it('should not allow maniplulating antiscript to run javascript', () => { + cy.visit('http://localhost:9000/xss5.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) }) diff --git a/cypress/platform/exploit.js b/cypress/platform/exploit.js new file mode 100644 index 000000000..2b4b0baa5 --- /dev/null +++ b/cypress/platform/exploit.js @@ -0,0 +1,6 @@ +const div = parent.document.createElement('div'); +div.id = 'the-malware'; +div.className = 'malware'; +div.innerHTML = 'XSS Succeeded'; +parent.document.getElementsByTagName('body')[0].appendChild(div); +throw new Error('XSS Succeded'); diff --git a/cypress/platform/knsv.html b/cypress/platform/knsv.html index d63d0e67f..40c26c569 100644 --- a/cypress/platform/knsv.html +++ b/cypress/platform/knsv.html @@ -66,18 +66,43 @@ stateDiagram-v2