add test for XSS from twitter

Author: mikesamuel

src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java

@@ -941,6 +941,23 @@ public String apply(String elementName, List<String> attrs) {
  scriptSanitizer.sanitize(htmlMetaCharsEscaped));
  }
 
+ @Test
+ public static final void testNoscriptInAttribute() {
+ PolicyFactory pf = new HtmlPolicyBuilder()
+ .allowElements("img", "p", "noscript")
+ .allowAttributes("title").globally()
+ .allowAttributes("img").onElements("img")
+ .toFactory();
+
+ assertEquals(
+ "<noscript>"
+ + "<p title=\"&lt;/noscript&gt;&lt;img src&#61;x onerror&#61;alert(1)&gt;\">"
+ + "</p>"
+ + "</noscript>",
+ pf.sanitize(
+ "<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">"));
+ }
+
  private static String apply(HtmlPolicyBuilder b) {
  return apply(b, EXAMPLE);
  }