diff --git a/src/node/util.ts b/src/node/util.ts index 09e439de..40ae9cef 100644 --- a/src/node/util.ts +++ b/src/node/util.ts @@ -520,5 +520,5 @@ export function escapeHtml(unsafe: string): string { .replace(//g, ">") .replace(/"/g, """) - .replace(/'/g, "'") + .replace(/'/g, "'") } diff --git a/test/unit/node/util.test.ts b/test/unit/node/util.test.ts index d089908b..d93cbd37 100644 --- a/test/unit/node/util.test.ts +++ b/test/unit/node/util.test.ts @@ -448,8 +448,8 @@ describe("onLine", () => { describe("escapeHtml", () => { it("should escape HTML", () => { - expect(util.escapeHtml(`
"Hello & world"
`)).toBe( - "<div class="error">"Hello & world"</div>", + expect(util.escapeHtml(`
"'ello & world"
`)).toBe( + "<div class="error">"'ello & world"</div>", ) }) }) diff --git a/test/unit/routes/login.test.ts b/test/unit/routes/login.test.ts index 9d68799b..c6e131bd 100644 --- a/test/unit/routes/login.test.ts +++ b/test/unit/routes/login.test.ts @@ -60,18 +60,14 @@ describe("login", () => { process.env.PASSWORD = previousEnvPassword }) - it("should return escaped HTML with 'Missing password' message", async () => { + it("should return HTML with 'Missing password' message", async () => { const resp = await codeServer().fetch("/login", { method: "POST" }) expect(resp.status).toBe(200) const htmlContent = await resp.text() - expect(htmlContent).not.toContain(">") - expect(htmlContent).not.toContain("<") - expect(htmlContent).not.toContain('"') - expect(htmlContent).not.toContain("'") - expect(htmlContent).toContain("<div class="error">Missing password</div>") + expect(htmlContent).toContain("Missing password") }) }) })