File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -619,6 +619,34 @@ describe('serialize( obj )', function () {
619619 strictEqual ( typeof deserialized , 'function' ) ;
620620 strictEqual ( deserialized ( ) , '</script\t>' ) ;
621621 } ) ;
622+
623+ it ( 'should encode script close variants in function bodies' , function ( ) {
624+ var payloads = [
625+ '</script>' ,
626+ '</SCRIPT>' ,
627+ '</Script>' ,
628+ '</script >' ,
629+ '</script\\t>' ,
630+ '</script\\n>' ,
631+ '</script\\r>' ,
632+ '</script\\f>' ,
633+ '</script/x>' ,
634+ '</script x>'
635+ ] ;
636+
637+ payloads . forEach ( function ( payload ) {
638+ var fn = new Function ( 'return ' + JSON . stringify ( payload ) ) ;
639+ var serialized = serialize ( fn ) ;
640+
641+ strictEqual ( serialized . includes ( '</script' ) , false ) ;
642+ strictEqual ( serialized . includes ( '</SCRIPT' ) , false ) ;
643+ strictEqual ( serialized . includes ( '</Script' ) , false ) ;
644+
645+ var deserialized ;
646+ eval ( 'deserialized = ' + serialized ) ;
647+ strictEqual ( deserialized ( ) , payload ) ;
648+ } ) ;
649+ } ) ;
622650 } ) ;
623651
624652 describe ( 'options' , function ( ) {
You can’t perform that action at this time.
0 commit comments