<commit_before>
describe "Sanitize mustache" do

  it "escapes html" do
    target <<-EOF
      <div>&amp; &#47; hello</div>
    EOF

    actual :hello=>'& / hello' do
      div { :hello }
    end
  end

  it "escapes html in nested values" do
    target <<-EOF
      <div id="my_box"><span>&amp; hello 1</span>
        <span>&amp;&amp; hello 2</span></div>
    EOF

    actual(:hello=>{:msg=>'& hello 1', :goodbye=>nil}) {
      div.*(:my_box) {
        render_if(:hello) {
          span { :msg } 
          render_unless(:goodbye) { span { '&& hello 2' } }
        }
      }
    }
  end

  it "escapes :href in nested values" do
    target %^<div><div><a href="&#47;hello">hello</a></div></div>^
    actual(o: {url: '/hello', msg: 'hello'}) {
      div {
        render_if(:o) {
          div { a.href(:url) { :msg } }
        }
      }
    }
  end

  it "raises ContextMiss if encounters unescaped value" do
    should.raise(Mustache::ContextMiss) {
      actual(blue: 'hello<') {
        div { '-- {{{ blue }}}' }
      }
    }.message.should.match /blue/
  end

end # === describe Sanitize mustache ===


<commit_msg>Added: spec to check for vars in form :action<commit_after>
describe "Sanitize mustache" do

  it "escapes html" do
    target <<-EOF
      <div>&amp; &#47; hello</div>
    EOF

    actual :hello=>'& / hello' do
      div { :hello }
    end
  end

  it "escapes html in nested values" do
    target <<-EOF
      <div id="my_box"><span>&amp; hello 1</span>
        <span>&amp;&amp; hello 2</span></div>
    EOF

    actual(:hello=>{:msg=>'& hello 1', :goodbye=>nil}) {
      div.*(:my_box) {
        render_if(:hello) {
          span { :msg } 
          render_unless(:goodbye) { span { '&& hello 2' } }
        }
      }
    }
  end

  it "escapes :href in nested values" do
    target %^<div><div><a href="&#47;hello">hello</a></div></div>^
    actual(o: {url: '/hello', msg: 'hello'}) {
      div {
        render_if(:o) {
          div { a.href(:url) { :msg } }
        }
      }
    }
  end

  it "does not allow vars to be used in form :action" do
    target %^<form action="url"><input type="hidden" name="auth_token" value="<PASSWORD>" /></form>^

    actual :auth_token => '<PASSWORD>' do
      form.action(:url) {}
    end
  end

  it "raises ContextMiss if encounters unescaped value" do
    should.raise(Mustache::ContextMiss) {
      actual(blue: 'hello<') {
        div { '-- {{{ blue }}}' }
      }
    }.message.should.match /blue/
  end

end # === describe Sanitize mustache ===



{'fraction_non_alphanumeric': 0.17810392701309005, 'fraction_numerical': 0.006346687822292741, 'mean_word_length': 2.200507614213198, 'pattern_counts': {'":': 0, '<': 46, '<?xml version=': 0, '>': 45, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7045096', 'n_tokens_mistral': 933, 'n_tokens_neox': 874, 'n_words': 222}