import { registerTooltip } from "discourse/lib/tooltip"; // prettier-ignore QUnit.module("lib:tooltip", { beforeEach() { fixture().html( ` test test ` ); } }); QUnit.test("text support", async assert => { const $testTextLink = fixture(".test-text-link"); registerTooltip($testTextLink); await $testTextLink.click(); assert.equal( fixture(".tooltip-content") .html() .trim(), "XSS<s onmouseover=alert(document.domain)>XSS", "it prevents XSS injection" ); assert.equal( fixture(".tooltip-content") .text() .trim(), "XSSXSS", "it returns content as plain text" ); }); QUnit.test("html support", async assert => { const $testHtmlLink = fixture(".test-html-link"); registerTooltip($testHtmlLink); await $testHtmlLink.click(); assert.equal( fixture(".tooltip-content") .html() .trim(), "

test

", "it doesn’t escape HTML" ); assert.equal( fixture(".tooltip-content") .text() .trim(), "test", "it returns content as plain text" ); });