| commit | author | age | ||
| 63d4b1 | 1 | <?php |
| T | 2 | |
| 3 | /** | |
| 4 | * Test class to test rcmail_mod_css_styles and XSS vulnerabilites | |
| 5 | * | |
| 6 | * @package Tests | |
| 7 | */ | |
| 8 | class rcube_test_modcss extends UnitTestCase | |
| 9 | { | |
| 10 | ||
| 11 | function __construct() | |
| 12 | { | |
| 13 | $this->UnitTestCase('CSS modification and vulnerability tests'); | |
| 14 | } | |
| 15 | ||
| 16 | function test_modcss() | |
| 17 | { | |
| 18 | $css = file_get_contents(TESTS_DIR . 'src/valid.css'); | |
| 19 | $mod = rcmail_mod_css_styles($css, 'rcmbody'); | |
| 20 | ||
| 21 | $this->assertPattern('/#rcmbody div.rcmBody\s+\{/', $mod, "Replace body style definition"); | |
| 22 | $this->assertPattern('/#rcmbody h1\s\{/', $mod, "Prefix tag styles (single)"); | |
| 23 | $this->assertPattern('/#rcmbody h1, #rcmbody h2, #rcmbody h3, #rcmbody textarea\s+\{/', $mod, "Prefix tag styles (multiple)"); | |
| 24 | $this->assertPattern('/#rcmbody \.noscript\s+\{/', $mod, "Prefix class styles"); | |
| 25 | } | |
| 26 | ||
| 27 | function test_xss() | |
| 28 | { | |
| 29 | $mod = rcmail_mod_css_styles("body.main2cols { background-image: url('../images/leftcol.png'); }", 'rcmbody'); | |
| 30 | $this->assertEqual("/* evil! */", $mod, "No url() values allowed"); | |
| 31 | ||
| 32 | $mod = rcmail_mod_css_styles("@import url('http://localhost/somestuff/css/master.css');", 'rcmbody'); | |
| 33 | $this->assertEqual("/* evil! */", $mod, "No import statements"); | |
| 34 | ||
| 35 | $mod = rcmail_mod_css_styles("left:expression(document.body.offsetWidth-20)", 'rcmbody'); | |
| 36 | $this->assertEqual("/* evil! */", $mod, "No expression properties"); | |
| 37 | ||
| 38 | $mod = rcmail_mod_css_styles("left:exp/* */ression( alert('xss3') )", 'rcmbody'); | |
| 39 | $this->assertEqual("/* evil! */", $mod, "Don't allow encoding quirks"); | |
| 40 | ||
| 41 | $mod = rcmail_mod_css_styles("background:\\0075\\0072\\006c( javascript:alert('xss') )", 'rcmbody'); | |
| 42 | $this->assertEqual("/* evil! */", $mod, "Don't allow encoding quirks (2)"); | |
| 43 | } | |
| 44 | ||
| 45 | } | |
