githubFork/roundcubemail.git

Aleksander Machniak

2016-01-16 768e3e1b09f2d9eeb906854cc2b3348f101f771a

commit \| author \| age
7ac944	1	<?php
AM	2
	3	/**
	4	* Test class to test rcube_washtml class
	5	*
	6	* @package Tests
	7	*/
	8	class Framework_Washtml extends PHPUnit_Framework_TestCase
	9	{
	10
	11	/**
	12	* Test the elimination of some XSS vulnerabilities
	13	*/
	14	function test_html_xss3()
	15	{
	16	// #1488850
	17	$html = '<p><a href="data:text/html,<script>alert(document.cookie)</script>">Firefox</a>'
	18	.'<a href="vbscript:alert(document.cookie)">Internet Explorer</a></p>';
	19
	20	$washer = new rcube_washtml;
	21	$washed = $washer->wash($html);
	22
	23	$this->assertNotRegExp('/data:text/', $washed, "Remove data:text/html links");
	24	$this->assertNotRegExp('/vbscript:/', $washed, "Remove vbscript: links");
	25	}
	26
1f910c	27	/**
AM	28	* Test fixing of invalid href (#1488940)
	29	*/
	30	function test_href()
	31	{
	32	$html = "<p><a href=\"\nhttp://test.com\n\">Firefox</a>";
	33
	34	$washer = new rcube_washtml;
	35	$washed = $washer->wash($html);
	36
	37	$this->assertRegExp('\|href="http://test.com">\|', $washed, "Link href with newlines (#1488940)");
	38	}
	39
1e2468	40	/**
AM	41	* Test handling HTML comments
	42	*/
	43	function test_comments()
	44	{
	45	$washer = new rcube_washtml;
	46
	47	$html = "<!--[if gte mso 10]><p>p1</p><!--><p>p2</p>";
	48	$washed = $washer->wash($html);
	49
c7c09f	50	$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>p2</p>', $washed, "HTML conditional comments (#1489004)");
1e2468	51
AM	52	$html = "<!--TestCommentInvalid><p>test</p>";
	53	$washed = $washer->wash($html);
	54
	55	$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>test</p>', $washed, "HTML invalid comments (#1487759)");
82ed25	56
AM	57	$html = "<p>para1</p><!-- comment --><p>para2</p>";
	58	$washed = $washer->wash($html);
	59
c7c09f	60	$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><p>para2</p>', $washed, "HTML comments - simple comment");
82ed25	61
AM	62	$html = "<p>para1</p><!-- <hr> comment --><p>para2</p>";
	63	$washed = $washer->wash($html);
	64
c7c09f	65	$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><p>para2</p>', $washed, "HTML comments - tags inside (#1489904)");
1e2468	66	}
AM	67
cb3e2f	68	/**
AM	69	* Test fixing of invalid self-closing elements (#1489137)
	70	*/
	71	function test_self_closing()
	72	{
	73	$html = "<textarea>test";
	74
	75	$washer = new rcube_washtml;
	76	$washed = $washer->wash($html);
	77
	78	$this->assertRegExp('\|<textarea>test</textarea>\|', $washed, "Self-closing textarea (#1489137)");
	79	}
	80
ffec85	81	/**
AM	82	* Test fixing of invalid closing tags (#1489446)
	83	*/
	84	function test_closing_tag_attrs()
	85	{
	86	$html = "<a href=\"http://test.com\">test</a href>";
	87
	88	$washer = new rcube_washtml;
	89	$washed = $washer->wash($html);
	90
	91	$this->assertRegExp('\|</a>\|', $washed, "Invalid closing tag (#1489446)");
	92	}
	93
c72507	94	/**
AM	95	* Test fixing of invalid lists nesting (#1488768)
	96	*/
	97	function test_lists()
	98	{
	99	$data = array(
	100	array(
	101	"<ol><li>First</li><li>Second</li><ul><li>First sub</li></ul><li>Third</li></ol>",
	102	"<ol><li>First</li><li>Second<ul><li>First sub</li></ul></li><li>Third</li></ol>"
	103	),
	104	array(
	105	"<ol><li>First<ul><li>First sub</li></ul></li></ol>",
	106	"<ol><li>First<ul><li>First sub</li></ul></li></ol>",
	107	),
	108	array(
	109	"<ol><li>First<ol><li>First sub</li></ol></li></ol>",
	110	"<ol><li>First<ol><li>First sub</li></ol></li></ol>",
	111	),
	112	array(
	113	"<ul><li>First</li><ul><li>First sub</li><ul><li>sub sub</li></ul></ul><li></li></ul>",
	114	"<ul><li>First<ul><li>First sub<ul><li>sub sub</li></ul></li></ul></li><li></li></ul>",
	115	),
	116	array(
	117	"<ul><li>First</li><li>second</li><ul><ul><li>sub sub</li></ul></ul></ul>",
	118	"<ul><li>First</li><li>second<ul><ul><li>sub sub</li></ul></ul></li></ul>",
	119	),
	120	array(
	121	"<ol><ol><ol></ol></ol></ol>",
	122	"<ol><ol><ol></ol></ol></ol>",
	123	),
	124	array(
	125	"<div><ol><ol><ol></ol></ol></ol></div>",
	126	"<div><ol><ol><ol></ol></ol></ol></div>",
	127	),
	128	);
	129
	130	foreach ($data as $element) {
	131	rcube_washtml::fix_broken_lists($element[0]);
	132
	133	$this->assertSame($element[1], $element[0], "Broken nested lists (#1488768)");
	134	}
	135	}
	136
68cf8f	137	/**
AM	138	* Test color style handling (#1489697)
	139	*/
	140	function test_color_style()
	141	{
	142	$html = "<p style=\"font-size: 10px; color: rgb(241, 245, 218)\">a</p>";
	143
	144	$washer = new rcube_washtml;
	145	$washed = $washer->wash($html);
	146
	147	$this->assertRegExp('\|color: rgb$241, 245, 218$\|', $washed, "Color style (#1489697)");
	148	$this->assertRegExp('\|font-size: 10px\|', $washed, "Font-size style");
	149	}
	150
5e3ee8	151	/**
AM	152	* Test handling of unicode chars in style (#1489777)
	153	*/
	154	function test_style_unicode()
	155	{
	156	$html = "<html><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />
f96fec	157	<body><span style='font-family:\"新細明體\",\"serif\";color:red'>test</span></body></html>";
5e3ee8	158
AM	159	$washer = new rcube_washtml;
	160	$washed = $washer->wash($html);
	161
786aa0	162	$this->assertRegExp('\|style="font-family: \"新細明體\",\"serif\"; color: red"\|', $washed, "Unicode chars in style attribute - quoted (#1489697)");
f96fec	163
AM	164	$html = "<html><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />
	165	<body><span style='font-family:新細明體;color:red'>test</span></body></html>";
	166
	167	$washer = new rcube_washtml;
	168	$washed = $washer->wash($html);
	169
	170	$this->assertRegExp('\|style="font-family: 新細明體; color: red"\|', $washed, "Unicode chars in style attribute (#1489697)");
5e3ee8	171	}
5bf83d	172
AM	173	/**
	174	* Test style item fixes
	175	*/
	176	function test_style_wash()
	177	{
	178	$html = "<p style=\"line-height: 1; height: 10\">a</p>";
	179
	180	$washer = new rcube_washtml;
	181	$washed = $washer->wash($html);
	182
	183	$this->assertRegExp('\|line-height: 1;\|', $washed, "Untouched line-height (#1489917)");
	184	$this->assertRegExp('\|; height: 10px\|', $washed, "Fixed height units");
ca7fc7	185
AM	186	$html = "<div style=\"padding: 0px\n 20px;border:1px solid #000;\"></div>";
	187	$expected = "<div style=\"padding: 0px 20px; border: 1px solid #000\"></div>";
	188
	189	$washer = new rcube_washtml;
	190	$washed = $washer->wash($html);
	191
	192	$this->assertTrue(strpos($washed, $expected) !== false, "White-space and new-line characters handling");
5bf83d	193	}
786aa0	194
AM	195	/**
	196	* Test invalid style cleanup - XSS prevention (#1490227)
	197	*/
	198	function test_style_wash_xss()
	199	{
	200	$html = "<img style=aaa:'\"/onerror=alert(1)//'>";
	201	$exp = "<img style=\"aaa: '"/onerror=alert(1)//'\" />";
	202
	203	$washer = new rcube_washtml;
	204	$washed = $washer->wash($html);
	205
	206	$this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)");
	207
	208	$html = "<img style=aaa:'"/onerror=alert(1)//'>";
	209	$exp = "<img style=\"aaa: '"/onerror=alert(1)//'\" />";
	210
	211	$washer = new rcube_washtml;
	212	$washed = $washer->wash($html);
	213
	214	$this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)");
	215	}
768e3e	216
AM	217	/**
	218	* Test SVG cleanup
	219	*/
	220	function test_style_wash_svg()
	221	{
	222	$svg = '<?xml version="1.0" standalone="no"?>
	223	<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
	224	<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" viewBox="0 0 100 100">
	225	<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400" onmouseover="alert(1)" />
	226	<text x="50" y="68" font-size="48" fill="#FFF" text-anchor="middle"><![CDATA[410]]></text>
	227	<script type="text/javascript">
	228	alert(document.cookie);
	229	</script>
	230	<text x="10" y="25" >An example text</text>
	231	<a xlink:href="http://www.w.pl"><rect width="100%" height="100%" /></a>
	232	<foreignObject xlink:href="data:text/xml,%3Cscript xmlns=\'http://www.w3.org/1999/xhtml\'%3Ealert(1)%3C/script%3E"/>
	233	<set attributeName="onmouseover" to="alert(1)"/>
	234	<animate attributeName="onunload" to="alert(1)"/>
	235	<animate attributeName="xlink:href" begin="0" from="javascript:alert(1)" />
	236	</svg>';
	237
	238	$exp = '<svg xmlns:cc="http://creativecommons.org/ns#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" version="1.1" baseProfile="full" viewBox="0 0 100 100">
	239	<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400" x-washed="onmouseover" />
	240	<text x="50" y="68" font-size="48" fill="#FFF" text-anchor="middle">410</text>
	241	<!-- script not allowed -->
	242	<text x="10" y="25">An example text</text>
	243	<a xlink:href="http://www.w.pl"><rect width="100%" height="100%" /></a>
	244	<!-- foreignObject ignored -->
	245	<set attributeName="onmouseover" x-washed="to" />
	246	<animate attributeName="onunload" x-washed="to" />
	247	<animate attributeName="xlink:href" begin="0" x-washed="from" />
	248	</svg>';
	249
	250	$washer = new rcube_washtml;
	251	$washed = $washer->wash($svg);
	252
	253	$this->assertSame($washed, $exp, "SVG content");
	254	}
7ac944	255	}