detect_double_xss_protection.rb

Before do
  Capybara.current_session.driver.rack_mock_session.after_request do
    body = Capybara.current_session.driver.response.body

    if match = body.match(%r{<\w+(?:\s+\w+\s*=\s*"[^&]+")*\s*/?>})
      puts "WARNING: escaped tag: " +
        match[0].gsub("&lt;", "<").gsub("&gt;", ">").gsub("&quot;", '"')
    end

    if match = body.match(%r{&amp;(\w+);})
      puts "WARNING: escaped entity: &#{match[1]};"
    end
  end
end

This is something we'd like to do at my office. Is there an updated version that will work with rack_test and capybara-webkit?

When I tried this with our test suite, it complains there is no method "rack_mock_session" for the driver.

@sdhull I haven't used this in years, but looking at more recent versions of capybara, it doesn't look like Rack::MockSession is used anymore. I think you could do some monkey-patching on Capybara::RackTest::Browser to achieve the same thing.

thanks @jferris I'll look into that next time I have some spare time! ;)