From eaa8077d09b1aa08ef5543595f259843a42004c0 Mon Sep 17 00:00:00 2001
From: mrkishi <mauriciokishi@gmail.com>
Date: Fri, 13 May 2022 20:04:30 -0300
Subject: [PATCH] add xss tests

---
 .../attribute-escaped-quotes-spread/_expected.html        | 8 +++++++-
 .../samples/attribute-escaped-quotes-spread/main.svelte   | 7 ++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html
index b3970f88ba..5db9a90fff 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html
@@ -2,4 +2,10 @@
 	bar="'></div><script>alert(42)</script>"
 	foo="&quot;></div><script>alert(42)</script>"
 	qux="&amp;&amp;&amp;"
-></div>
\ No newline at end of file
+	quux="&quot;><script>alert(42)</script>"
+></div>
+
+<div
+	foo="foo"
+	unsafe="&quot;><script>alert(42)</script>"
+></div>
diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.svelte b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.svelte
index 66047eb09a..9d721cd88f 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.svelte
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.svelte
@@ -1,10 +1,15 @@
 <script>
+	const safe = { foo: 'foo' };
+	const unsafe = { toString: () => '"><script>alert(42)<\/script>' };
+
 	export let props = {
 		foo: '"></div><script>alert(42)</' + 'script>',
 		bar: "'></div><script>alert(42)</" + 'script>',
 		['"></div><script>alert(42)</' + 'script>']: 'baz',
 		qux: '&&&',
+		quux: unsafe
 	};
 </script>
 
-<div {...props}></div>
\ No newline at end of file
+<div {...props}></div>
+<div {...safe} {unsafe}></div>