@@ -0,0 +1,2457 @@
+package org.biouno.unochoice;%0A%0Aimport hudson.model.Job;%0Aimport jenkins.model.Jenkins;%0Aimport org.biouno.unochoice.model.GroovyScript;%0Aimport org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript;%0Aimport org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval;%0Aimport org.jenkinsci.plugins.scriptsecurity.scripts.languages.GroovyLanguage;%0Aimport org.junit.Assert;%0Aimport org.junit.Rule;%0Aimport org.junit.Test;%0Aimport org.jvnet.hudson.test.JenkinsRule;%0Aimport org.jvnet.hudson.test.MockAuthorizationStrategy;%0A%0Apublic class Security470Test %7B%0A%0A    @Rule%0A    public JenkinsRule j = new JenkinsRule();%0A%0A    @Test%0A    public void testSanitization() throws Exception %7B%0A        j.jenkins.setSecurityRealm(j.createDummySecurityRealm());%0A        MockAuthorizationStrategy strategy = new MockAuthorizationStrategy();%0A        strategy.grant(Jenkins.READ).onRoot().toEveryone();%0A        strategy.grant(Job.CREATE, Job.READ, Job.CONFIGURE).everywhere().toAuthenticated();%0A        j.jenkins.setAuthorizationStrategy(strategy);%0A%0A        %7B // test HTML gets sanitized when run in sandbox%0A            GroovyScript script = new GroovyScript(new SecureGroovyScript(%22return '%3Cimg src=%5C%5C'fail%5C%5C' onerror=%5C%5C'alert(%5C%22foo%5C%22);%5C%5C' /%3E%3Cb%3Etext%3C/b%3E'%22, true, null),%0A                    null);%0A            DynamicReferenceParameter param = new DynamicReferenceParameter(%22whatever%22, %22description%22, %22some-random-name%22,%0A                    script, CascadeChoiceParameter.ELEMENT_TYPE_FORMATTED_HTML, %22%22, true);%0A            Assert.assertEquals(%22%3Cimg src=%5C%22fail%5C%22%3E%3Cb%3Etext%3C/b%3E%22, param.getChoicesAsStringForUI());%0A        %7D%0A%0A        %7B // test HTML does not get sanitized when run outside the sandbox%0A            String htmlScript = %22return '%3Cimg src=%5C%5C'fail%5C%5C' onerror=%5C%5C'alert(%5C%22foo%5C%22);%5C%5C' /%3E%3Cb%3Etext%3C/b%3E'%22;%0A            GroovyScript script = new GroovyScript(new SecureGroovyScript(htmlScript, false, null),%0A                    null);%0A            DynamicReferenceParameter param = new DynamicReferenceParameter(%22whatever%22, %22description%22, %22some-random-name%22,%0A                    script, CascadeChoiceParameter.ELEMENT_TYPE_FORMATTED_HTML, %22%22, true);%0A            Assert.assertEquals(%22%7B%7D%22, param.getChoicesAsStringForUI()); // not yet approved%0A%0A            ScriptApproval.get().preapprove(htmlScript, GroovyLanguage.get());%0A%0A            Assert.assertEquals(%22%3Cimg src='fail' onerror='alert(%5C%22foo%5C%22);' /%3E%3Cb%3Etext%3C/b%3E%22, param.getChoicesAsStringForUI()); // approved%0A        %7D%0A    %7D%0A%7D%0A

Add test