forgejo/tests/integration/fixtures/TestXSSReviewDismissed/comment.yml

-
  id: 1000
  type: 32 # dismiss review
  poster_id: 2
  issue_id: 2 # in repo_id 1
  content: "XSS time!"
  review_id: 1000
  created_unix: 1700000000
  updated_unix: 1700000000
[SECURITY] Test XSS in dismissed review It's possible for reviews to not be assiocated with users, when they were migrated from another forge instance. In the migration code, there's no sanitization check for author names, so they could contain HTML tags and thus needs to be properely escaped. 2024-01-17 23:18:39 +00:00			`-`
			`id: 1000`
			`type: 32 # dismiss review`
			`poster_id: 2`
			`issue_id: 2 # in repo_id 1`
			`content: "XSS time!"`
			`review_id: 1000`
			`created_unix: 1700000000`
			`updated_unix: 1700000000`