Repository: angular/angular.js
File: test/ngSanitize/sanitizeSpec.js (JavaScript)

Code before:
    expectHTML('\na\n').toEqual('&#10;a&#10;');
  });

  it('should accept tag delimiters such as "<" inside real tags (with nesting)', function() {
    //this is an integrated version of the 'should accept tag delimiters such as "<" inside real tags' test
    expectHTML('<p> 10 < <span>100</span> </p>')
    .toEqual('<p> 10 &lt; <span>100</span> </p>');
  });

  it('should accept non-string arguments', function() {
    expectHTML(null).toBe('');
    expectHTML(undefined).toBe('');
    expectHTML(42).toBe('42');
    expectHTML({}).toBe('[object Object]');
    expectHTML([1, 2, 3]).toBe('1,2,3');
    expectHTML(true).toBe('true');
    expectHTML(false).toBe('false');
  });


  it('should strip svg elements if not enabled via provider', function() {
    expectHTML('<svg width="400px" height="150px" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red"></svg>')
      .toEqual('');
  });

  if (isChrome) {
    it('should prevent mXSS attacks', function() {
      expectHTML('<a href="&#x3000;javascript:alert(1)">CLICKME</a>').toBe('<a>CLICKME</a>');
    });
  }

  it('should strip html comments', function() {
    expectHTML('<!-- comment 1 --><p>text1<!-- comment 2 -->text2</p><!-- comment 3 -->')
      .toEqual('<p>text1text2</p>');
  });

  it('should throw on clobbered elements', function() {
    inject(function($sanitize) {
      expect(function() {
        $sanitize('<form><input name="parentNode" /></form>');
      }).toThrowMinErr('$sanitize', 'elclob');

      expect(function() {
        $sanitize('<form><div><div><input name="parentNode" /></div></div></form>');
      }).toThrowMinErr('$sanitize', 'elclob');

      expect(function() {
        $sanitize('<form><input name="nextSibling" /></form>');
      }).toThrowMinErr('$sanitize', 'elclob');

      expect(function() {

Review comment (security):
TBH, I don't think this test does what it says it does, but that is not related to this PR (it was like that before).
(It is more like `it should not be too strict in preventing mXSS aattacks` :smiley:)

Code after:
    expectHTML('\na\n').toEqual('&#10;a&#10;');
  });

  it('should accept tag delimiters such as "<" inside real tags (with nesting)', function() {
    //this is an integrated version of the 'should accept tag delimiters such as "<" inside real tags' test
    expectHTML('<p> 10 < <span>100</span> </p>')
    .toEqual('<p> 10 &lt; <span>100</span> </p>');
  });

  it('should accept non-string arguments', function() {
    expectHTML(null).toBe('');
    expectHTML(undefined).toBe('');
    expectHTML(42).toBe('42');
    expectHTML({}).toBe('[object Object]');
    expectHTML([1, 2, 3]).toBe('1,2,3');
    expectHTML(true).toBe('true');
    expectHTML(false).toBe('false');
  });


  it('should strip svg elements if not enabled via provider', function() {
    expectHTML('<svg width="400px" height="150px" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red"></svg>')
      .toEqual('');
  });

  it('should prevent mXSS attacks', function() {
    expectHTML('<a href="&#x3000;javascript:alert(1)">CLICKME</a>').toBe('<a>CLICKME</a>');
  });

  it('should strip html comments', function() {
    expectHTML('<!-- comment 1 --><p>text1<!-- comment 2 -->text2</p><!-- comment 3 -->')
      .toEqual('<p>text1text2</p>');
  });

  it('should throw on clobbered elements', function() {
    inject(function($sanitize) {
      expect(function() {
        $sanitize('<form><input name="parentNode" /></form>');
      }).toThrowMinErr('$sanitize', 'elclob');

      expect(function() {
        $sanitize('<form><div><div><input name="parentNode" /></div></div></form>');
      }).toThrowMinErr('$sanitize', 'elclob');

      expect(function() {
        $sanitize('<form><input name="nextSibling" /></form>');
      }).toThrowMinErr('$sanitize', 'elclob');

      expect(function() {
        $sanitize('<form><div><div><input name="nextSibling" /></div></div></form>');
      }).toThrowMinErr('$sanitize', 'elclob');