Test: sjekk på attributt (onsubmit=), ikke ordet i kommentar

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcEy43fNYpwg6K6oTKakWR
This commit is contained in:
Ole-Morten Duesund 2026-08-26 12:19:07 +02:00
commit d6e5243d25

View file

@ -155,5 +155,5 @@ def test_no_inline_js_with_content(client, cfg):
title = "Ola's \"test\" <b>"
r = client.post(f"/admin/edit/{post_id}", data={"csrf": token, "title": title, "body": "x", "action": "save"})
html = client.get(r.headers["Location"]).text
assert "onsubmit" not in html and "onclick" not in html
assert "onsubmit=" not in html and "onclick=" not in html
assert "Ola&#39;s" in html