| commit | author | age | ||
| 63d4b1 | 1 | <?php |
| T | 2 | |
| 3 | /** | |
| 4 | * Test class to test steps/mail/func.inc functions | |
| 5 | * | |
| 6 | * @package Tests | |
| 7 | */ | |
| 8 | class rcube_test_mailfunc extends UnitTestCase | |
| 9 | { | |
| 10 | ||
| 11 | function __construct() | |
| 12 | { | |
| 13 | $this->UnitTestCase('Mail body rendering tests'); | |
| 14 | ||
| 15 | // simulate environment to successfully include func.inc | |
| 16 | $GLOBALS['RCMAIL'] = $RCMAIL = rcmail::get_instance(); | |
| 17 | $GLOBALS['OUTPUT'] = $OUTPUT = $RCMAIL->load_gui(); | |
| 18 | $RCMAIL->action = 'spell'; | |
| 19 | $IMAP = $RCMAIL->imap; | |
| 20 | ||
| 21 | require_once 'steps/mail/func.inc'; | |
| 115263 | 22 | |
| T | 23 | $GLOBALS['EMAIL_ADDRESS_PATTERN'] = $EMAIL_ADDRESS_PATTERN; |
| 63d4b1 | 24 | } |
| T | 25 | |
| 26 | /** | |
| 27 | * Helper method to create a HTML message part object | |
| 28 | */ | |
| 29 | function get_html_part($body) | |
| 30 | { | |
| 31 | $part = new rcube_message_part; | |
| 32 | $part->ctype_primary = 'text'; | |
| 33 | $part->ctype_secondary = 'html'; | |
| 34 | $part->body = file_get_contents(TESTS_DIR . $body); | |
| 35 | $part->replaces = array(); | |
| 36 | return $part; | |
| 37 | } | |
| 38 | ||
| 39 | /** | |
| 40 | * Test sanitization of a "normal" html message | |
| 41 | */ | |
| 42 | function test_html() | |
| 43 | { | |
| 44 | $part = $this->get_html_part('src/htmlbody.txt'); | |
| 45 | $part->replaces = array('ex1.jpg' => 'part_1.2.jpg', 'ex2.jpg' => 'part_1.2.jpg'); | |
| 46 | ||
| 47 | // render HTML in normal mode | |
| 115263 | 48 | $html = rcmail_html4inline(rcmail_print_body($part, array('safe' => false)), 'foo'); |
| 63d4b1 | 49 | |
| T | 50 | $this->assertPattern('/src="'.$part->replaces['ex1.jpg'].'"/', $html, "Replace reference to inline image"); |
| 51 | $this->assertPattern('#background="./program/blocked.gif"#', $html, "Replace external background image"); | |
| 52 | $this->assertNoPattern('/ex3.jpg/', $html, "No references to external images"); | |
| 53 | $this->assertNoPattern('/<meta [^>]+>/', $html, "No meta tags allowed"); | |
| 5570ad | 54 | //$this->assertNoPattern('/<style [^>]+>/', $html, "No style tags allowed"); |
| 63d4b1 | 55 | $this->assertNoPattern('/<form [^>]+>/', $html, "No form tags allowed"); |
| T | 56 | $this->assertPattern('/Subscription form/', $html, "Include <form> contents"); |
| 5570ad | 57 | $this->assertPattern('/<!-- input ignored -->/', $html, "No input elements allowed"); |
| T | 58 | $this->assertPattern('/<!-- link ignored -->/', $html, "No external links allowed"); |
| 63d4b1 | 59 | $this->assertPattern('/<a[^>]+ target="_blank">/', $html, "Set target to _blank"); |
| T | 60 | $this->assertTrue($GLOBALS['REMOTE_OBJECTS'], "Remote object detected"); |
| 61 | ||
| 62 | // render HTML in safe mode | |
| 961afa | 63 | $html2 = rcmail_html4inline(rcmail_print_body($part, array('safe' => true)), 'foo'); |
| 63d4b1 | 64 | |
| T | 65 | $this->assertPattern('/<style [^>]+>/', $html2, "Allow styles in safe mode"); |
| 66 | $this->assertPattern('#src="http://evilsite.net/mailings/ex3.jpg"#', $html2, "Allow external images in HTML (safe mode)"); | |
| 67 | $this->assertPattern("#url\('http://evilsite.net/newsletter/image/bg/bg-64.jpg'\)#", $html2, "Allow external images in CSS (safe mode)"); | |
| 961afa | 68 | |
| T | 69 | $css = '<link rel="stylesheet" type="text/css" href="./bin/modcss.php?u='.urlencode('http://anysite.net/styles/mail.css').'&c=foo"'; |
| 70 | $this->assertPattern('#'.preg_quote($css).'#', $html2, "Filter external styleseehts with bin/modcss.php"); | |
| 63d4b1 | 71 | } |
| T | 72 | |
| 73 | /** | |
| 74 | * Test the elimination of some trivial XSS vulnerabilities | |
| 75 | */ | |
| 76 | function test_html_xss() | |
| 77 | { | |
| 78 | $part = $this->get_html_part('src/htmlxss.txt'); | |
| 79 | $washed = rcmail_print_body($part, array('safe' => true)); | |
| 115263 | 80 | |
| 63d4b1 | 81 | $this->assertNoPattern('/src="skins/', $washed, "Remove local references"); |
| 115263 | 82 | $this->assertNoPattern('/\son[a-z]+/', $washed, "Remove on* attributes"); |
| T | 83 | |
| 84 | $html = rcmail_html4inline($washed, 'foo'); | |
| 85 | $this->assertNoPattern('/onclick="return rcmail.command(\'compose\',\'xss@somehost.net\',this)"/', $html, "Clean mailto links"); | |
| 86 | $this->assertNoPattern('/alert/', $html, "Remove alerts"); | |
| 63d4b1 | 87 | } |
| T | 88 | |
| 89 | /** | |
| 90 | * Test HTML sanitization to fix the CSS Expression Input Validation Vulnerability | |
| 91 | * reported at http://www.securityfocus.com/bid/26800/ | |
| 92 | */ | |
| 93 | function test_html_xss2() | |
| 94 | { | |
| 95 | $part = $this->get_html_part('src/BID-26800.txt'); | |
| 96 | $washed = rcmail_print_body($part, array('safe' => true)); | |
| 97 | ||
| 98 | $this->assertNoPattern('/alert|expression|javascript|xss/', $washed, "Remove evil style blocks"); | |
| 99 | $this->assertNoPattern('/font-style:italic/', $washed, "Allow valid styles"); | |
| 100 | } | |
| 101 | ||
| 102 | /** | |
| 103 | * Test links pattern replacements in plaintext messages | |
| 104 | */ | |
| 105 | function test_plaintext() | |
| 106 | { | |
| 107 | $part = new rcube_message_part; | |
| 108 | $part->ctype_primary = 'text'; | |
| 109 | $part->ctype_secondary = 'plain'; | |
| 110 | $part->body = quoted_printable_decode(file_get_contents(TESTS_DIR . 'src/plainbody.txt')); | |
| 111 | $html = rcmail_print_body($part, array('safe' => true)); | |
| 112 | ||
| 113 | $this->assertPattern('/<a href="mailto:nobody@roundcube.net" onclick="return rcmail.command\(\'compose\',\'nobody@roundcube.net\',this\)">nobody@roundcube.net<\/a>/', $html, "Mailto links with onclick"); | |
| 114 | $this->assertPattern('#<a href="http://www.apple.com/legal/privacy/" target="_blank">http://www.apple.com/legal/privacy/</a>#', $html, "Links with target=_blank"); | |
| 115 | } | |
| 116 | ||
| ad18d6 | 117 | /** |
| A | 118 | * Test mailto links in html messages |
| 119 | */ | |
| 120 | function test_mailto() | |
| 121 | { | |
| 122 | $part = $this->get_html_part('src/mailto.txt'); | |
| 123 | ||
| 124 | // render HTML in normal mode | |
| 125 | $html = rcmail_html4inline(rcmail_print_body($part, array('safe' => false)), 'foo'); | |
| 126 | ||
| 127 | $mailto = '<a href="mailto:me@me.com?subject=this is the subject&body=this is the body"' | |
| 128 | .' onclick="return rcmail.command(\'compose\',\'me@me.com?subject=this is the subject&body=this is the body\',this)">e-mail</a>'; | |
| 129 | ||
| 130 | $this->assertPattern('|'.preg_quote($mailto, '|').'|', $html, "Extended mailto links"); | |
| 131 | } | |
| 132 | ||
| 63d4b1 | 133 | } |
| T | 134 | |
| 135 | ?> | |
