|
466 | 466 | });
|
467 | 467 |
|
468 | 468 | QUnit.test('#2911 - _.template must not trigger CVE-2021-23337.', function(assert) {
|
469 |
| - QUnit.holyProperty = 'holy'; |
470 |
| - var invalidVariableNames = [ |
471 |
| - '){delete QUnit.holyProperty}; with(obj', |
472 |
| - '(x = QUnit.holyProperty = "evil"), obj', |
473 |
| - 'document.write("got you!")' |
474 |
| - ]; |
475 |
| - _.each(invalidVariableNames, function(name) { |
476 |
| - assert.throws(function() { _.template('', { variable: name })(); }); |
477 |
| - }); |
478 |
| - var holy = QUnit.holyProperty; |
479 |
| - delete QUnit.holyProperty; |
480 |
| - assert.strictEqual(holy, 'holy'); |
| 469 | + QUnit.holyProperty = 'holy'; |
| 470 | + var invalidVariableNames = [ |
| 471 | + '){delete QUnit.holyProperty}; with(obj', |
| 472 | + '(x = QUnit.holyProperty = "evil"), obj', |
| 473 | + 'document.write("got you!")' |
| 474 | + ]; |
| 475 | + _.each(invalidVariableNames, function(name) { |
| 476 | + assert.throws(function() { _.template('', { variable: name })(); }); |
| 477 | + }); |
| 478 | + var holy = QUnit.holyProperty; |
| 479 | + delete QUnit.holyProperty; |
| 480 | + assert.strictEqual(holy, 'holy'); |
481 | 481 | });
|
482 | 482 |
|
483 | 483 | }());
|
0 commit comments