commit | author | age
|
7ac944
|
1 |
<?php |
AM |
2 |
|
|
3 |
/** |
|
4 |
* Test class to test rcube_washtml class |
|
5 |
* |
|
6 |
* @package Tests |
|
7 |
*/ |
|
8 |
class Framework_Washtml extends PHPUnit_Framework_TestCase |
|
9 |
{ |
|
10 |
|
|
11 |
/** |
|
12 |
* Test the elimination of some XSS vulnerabilities |
|
13 |
*/ |
|
14 |
function test_html_xss3() |
|
15 |
{ |
|
16 |
// #1488850 |
|
17 |
$html = '<p><a href="data:text/html,<script>alert(document.cookie)</script>">Firefox</a>' |
|
18 |
.'<a href="vbscript:alert(document.cookie)">Internet Explorer</a></p>'; |
|
19 |
|
|
20 |
$washer = new rcube_washtml; |
|
21 |
$washed = $washer->wash($html); |
|
22 |
|
|
23 |
$this->assertNotRegExp('/data:text/', $washed, "Remove data:text/html links"); |
|
24 |
$this->assertNotRegExp('/vbscript:/', $washed, "Remove vbscript: links"); |
|
25 |
} |
|
26 |
|
1f910c
|
27 |
/** |
AM |
28 |
* Test fixing of invalid href (#1488940) |
|
29 |
*/ |
|
30 |
function test_href() |
|
31 |
{ |
|
32 |
$html = "<p><a href=\"\nhttp://test.com\n\">Firefox</a>"; |
|
33 |
|
|
34 |
$washer = new rcube_washtml; |
|
35 |
$washed = $washer->wash($html); |
|
36 |
|
|
37 |
$this->assertRegExp('|href="http://test.com">|', $washed, "Link href with newlines (#1488940)"); |
|
38 |
} |
|
39 |
|
1e2468
|
40 |
/** |
AM |
41 |
* Test handling HTML comments |
|
42 |
*/ |
|
43 |
function test_comments() |
|
44 |
{ |
|
45 |
$washer = new rcube_washtml; |
|
46 |
|
|
47 |
$html = "<!--[if gte mso 10]><p>p1</p><!--><p>p2</p>"; |
|
48 |
$washed = $washer->wash($html); |
|
49 |
|
c7c09f
|
50 |
$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>p2</p>', $washed, "HTML conditional comments (#1489004)"); |
1e2468
|
51 |
|
AM |
52 |
$html = "<!--TestCommentInvalid><p>test</p>"; |
|
53 |
$washed = $washer->wash($html); |
|
54 |
|
|
55 |
$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>test</p>', $washed, "HTML invalid comments (#1487759)"); |
82ed25
|
56 |
|
AM |
57 |
$html = "<p>para1</p><!-- comment --><p>para2</p>"; |
|
58 |
$washed = $washer->wash($html); |
|
59 |
|
c7c09f
|
60 |
$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><p>para2</p>', $washed, "HTML comments - simple comment"); |
82ed25
|
61 |
|
AM |
62 |
$html = "<p>para1</p><!-- <hr> comment --><p>para2</p>"; |
|
63 |
$washed = $washer->wash($html); |
|
64 |
|
c7c09f
|
65 |
$this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><p>para2</p>', $washed, "HTML comments - tags inside (#1489904)"); |
1e2468
|
66 |
} |
AM |
67 |
|
cb3e2f
|
68 |
/** |
AM |
69 |
* Test fixing of invalid self-closing elements (#1489137) |
|
70 |
*/ |
|
71 |
function test_self_closing() |
|
72 |
{ |
|
73 |
$html = "<textarea>test"; |
|
74 |
|
|
75 |
$washer = new rcube_washtml; |
|
76 |
$washed = $washer->wash($html); |
|
77 |
|
|
78 |
$this->assertRegExp('|<textarea>test</textarea>|', $washed, "Self-closing textarea (#1489137)"); |
|
79 |
} |
|
80 |
|
ffec85
|
81 |
/** |
AM |
82 |
* Test fixing of invalid closing tags (#1489446) |
|
83 |
*/ |
|
84 |
function test_closing_tag_attrs() |
|
85 |
{ |
|
86 |
$html = "<a href=\"http://test.com\">test</a href>"; |
|
87 |
|
|
88 |
$washer = new rcube_washtml; |
|
89 |
$washed = $washer->wash($html); |
|
90 |
|
|
91 |
$this->assertRegExp('|</a>|', $washed, "Invalid closing tag (#1489446)"); |
|
92 |
} |
|
93 |
|
c72507
|
94 |
/** |
AM |
95 |
* Test fixing of invalid lists nesting (#1488768) |
|
96 |
*/ |
|
97 |
function test_lists() |
|
98 |
{ |
|
99 |
$data = array( |
|
100 |
array( |
|
101 |
"<ol><li>First</li><li>Second</li><ul><li>First sub</li></ul><li>Third</li></ol>", |
|
102 |
"<ol><li>First</li><li>Second<ul><li>First sub</li></ul></li><li>Third</li></ol>" |
|
103 |
), |
|
104 |
array( |
|
105 |
"<ol><li>First<ul><li>First sub</li></ul></li></ol>", |
|
106 |
"<ol><li>First<ul><li>First sub</li></ul></li></ol>", |
|
107 |
), |
|
108 |
array( |
|
109 |
"<ol><li>First<ol><li>First sub</li></ol></li></ol>", |
|
110 |
"<ol><li>First<ol><li>First sub</li></ol></li></ol>", |
|
111 |
), |
|
112 |
array( |
|
113 |
"<ul><li>First</li><ul><li>First sub</li><ul><li>sub sub</li></ul></ul><li></li></ul>", |
|
114 |
"<ul><li>First<ul><li>First sub<ul><li>sub sub</li></ul></li></ul></li><li></li></ul>", |
|
115 |
), |
|
116 |
array( |
|
117 |
"<ul><li>First</li><li>second</li><ul><ul><li>sub sub</li></ul></ul></ul>", |
|
118 |
"<ul><li>First</li><li>second<ul><ul><li>sub sub</li></ul></ul></li></ul>", |
|
119 |
), |
|
120 |
array( |
|
121 |
"<ol><ol><ol></ol></ol></ol>", |
|
122 |
"<ol><ol><ol></ol></ol></ol>", |
|
123 |
), |
|
124 |
array( |
|
125 |
"<div><ol><ol><ol></ol></ol></ol></div>", |
|
126 |
"<div><ol><ol><ol></ol></ol></ol></div>", |
|
127 |
), |
|
128 |
); |
|
129 |
|
|
130 |
foreach ($data as $element) { |
|
131 |
rcube_washtml::fix_broken_lists($element[0]); |
|
132 |
|
|
133 |
$this->assertSame($element[1], $element[0], "Broken nested lists (#1488768)"); |
|
134 |
} |
|
135 |
} |
|
136 |
|
68cf8f
|
137 |
/** |
AM |
138 |
* Test color style handling (#1489697) |
|
139 |
*/ |
|
140 |
function test_color_style() |
|
141 |
{ |
|
142 |
$html = "<p style=\"font-size: 10px; color: rgb(241, 245, 218)\">a</p>"; |
|
143 |
|
|
144 |
$washer = new rcube_washtml; |
|
145 |
$washed = $washer->wash($html); |
|
146 |
|
|
147 |
$this->assertRegExp('|color: rgb\(241, 245, 218\)|', $washed, "Color style (#1489697)"); |
|
148 |
$this->assertRegExp('|font-size: 10px|', $washed, "Font-size style"); |
|
149 |
} |
|
150 |
|
5e3ee8
|
151 |
/** |
AM |
152 |
* Test handling of unicode chars in style (#1489777) |
|
153 |
*/ |
|
154 |
function test_style_unicode() |
|
155 |
{ |
|
156 |
$html = "<html><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /> |
f96fec
|
157 |
<body><span style='font-family:\"新細明體\",\"serif\";color:red'>test</span></body></html>"; |
5e3ee8
|
158 |
|
AM |
159 |
$washer = new rcube_washtml; |
|
160 |
$washed = $washer->wash($html); |
|
161 |
|
786aa0
|
162 |
$this->assertRegExp('|style="font-family: \"新細明體\",\"serif\"; color: red"|', $washed, "Unicode chars in style attribute - quoted (#1489697)"); |
f96fec
|
163 |
|
AM |
164 |
$html = "<html><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /> |
|
165 |
<body><span style='font-family:新細明體;color:red'>test</span></body></html>"; |
|
166 |
|
|
167 |
$washer = new rcube_washtml; |
|
168 |
$washed = $washer->wash($html); |
|
169 |
|
|
170 |
$this->assertRegExp('|style="font-family: 新細明體; color: red"|', $washed, "Unicode chars in style attribute (#1489697)"); |
5e3ee8
|
171 |
} |
5bf83d
|
172 |
|
AM |
173 |
/** |
|
174 |
* Test style item fixes |
|
175 |
*/ |
|
176 |
function test_style_wash() |
|
177 |
{ |
|
178 |
$html = "<p style=\"line-height: 1; height: 10\">a</p>"; |
|
179 |
|
|
180 |
$washer = new rcube_washtml; |
|
181 |
$washed = $washer->wash($html); |
|
182 |
|
|
183 |
$this->assertRegExp('|line-height: 1;|', $washed, "Untouched line-height (#1489917)"); |
|
184 |
$this->assertRegExp('|; height: 10px|', $washed, "Fixed height units"); |
ca7fc7
|
185 |
|
AM |
186 |
$html = "<div style=\"padding: 0px\n 20px;border:1px solid #000;\"></div>"; |
|
187 |
$expected = "<div style=\"padding: 0px 20px; border: 1px solid #000\"></div>"; |
|
188 |
|
|
189 |
$washer = new rcube_washtml; |
|
190 |
$washed = $washer->wash($html); |
|
191 |
|
|
192 |
$this->assertTrue(strpos($washed, $expected) !== false, "White-space and new-line characters handling"); |
5bf83d
|
193 |
} |
786aa0
|
194 |
|
AM |
195 |
/** |
|
196 |
* Test invalid style cleanup - XSS prevention (#1490227) |
|
197 |
*/ |
|
198 |
function test_style_wash_xss() |
|
199 |
{ |
|
200 |
$html = "<img style=aaa:'\"/onerror=alert(1)//'>"; |
|
201 |
$exp = "<img style=\"aaa: '"/onerror=alert(1)//'\" />"; |
|
202 |
|
|
203 |
$washer = new rcube_washtml; |
|
204 |
$washed = $washer->wash($html); |
|
205 |
|
|
206 |
$this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)"); |
|
207 |
|
|
208 |
$html = "<img style=aaa:'"/onerror=alert(1)//'>"; |
|
209 |
$exp = "<img style=\"aaa: '"/onerror=alert(1)//'\" />"; |
|
210 |
|
|
211 |
$washer = new rcube_washtml; |
|
212 |
$washed = $washer->wash($html); |
|
213 |
|
|
214 |
$this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)"); |
|
215 |
} |
7ac944
|
216 |
} |