#{selenium 'Test xss attack'} %{ def customCode = "\">" ; }% open('@{security.XssAttempts.testUrlParam(customCode )}') assertHtmlSource('*href="/xsstest?url=${customCode.urlEncode()}*') open('@{security.XssAttempts.testUrlParam(":" + customCode )}') assertHtmlSource('*href="/xsstest?url=:${customCode.urlEncode()}*') #{/selenium} #{selenium 'Test xss attack'} open('@{security.XssAttempts.testUrlParam(':">')}') // assert that script tags are properly escaped assertAttribute('xpath=//a[1]@href','/xsstest?url=:%22%3E%3Cscript%3Ealert%28%22oh%22%29%3C%2Fscript%3E') #{/selenium}