Daily Usage Issues

TimeLine.html is not escaping HTML for test name

Started by GreenMoose on 2,695 views

[NCrunch Console Tool v3.23.0.9]

The generated TimeLine.html does not seem to escape HTML so e.g. below results in a popup "123" when viewed in a browser (or in a TeamCity tab):

                   <div class="passingtest"><div style="display:inline;margin-left: 10px;"><i data-feather="check"></i> MiscFixtures.GetReminderTextReturnsHtmlEncodedMessage("test reminder")</div></div>
                   <div class="passingtest"><div style="display:inline;margin-left: 10px;"><i data-feather="check"></i> MiscFixtures.*</div></div>
                   <div class="passingtest"><div style="display:inline;margin-left: 10px;"><i data-feather="check"></i> MiscFixtures.GetReminderTextReturnsHtmlEncodedMessage("test reminder<br/><script>alert(123);</script>")</div></div>

This is fixed in the upcoming release. Thanks again!

Post a reply

Log in to reply.