| commit | author | age | ||
| 7ac944 | 1 | <?php |
| AM | 2 | |
| 3 | /** | |
| 4 | * Test class to test rcube_washtml class | |
| 5 | * | |
| 6 | * @package Tests | |
| 7 | */ | |
| 8 | class Framework_Washtml extends PHPUnit_Framework_TestCase | |
| 9 | { | |
| 10 | ||
| 11 | /** | |
| 12 | * Test the elimination of some XSS vulnerabilities | |
| 13 | */ | |
| 14 | function test_html_xss3() | |
| 15 | { | |
| 16 | // #1488850 | |
| 17 | $html = '<p><a href="data:text/html,<script>alert(document.cookie)</script>">Firefox</a>' | |
| 18 | .'<a href="vbscript:alert(document.cookie)">Internet Explorer</a></p>'; | |
| 19 | ||
| 20 | $washer = new rcube_washtml; | |
| 21 | $washed = $washer->wash($html); | |
| 22 | ||
| 23 | $this->assertNotRegExp('/data:text/', $washed, "Remove data:text/html links"); | |
| 24 | $this->assertNotRegExp('/vbscript:/', $washed, "Remove vbscript: links"); | |
| 25 | } | |
| 26 | ||
| 1f910c | 27 | /** |
| AM | 28 | * Test fixing of invalid href (#1488940) |
| 29 | */ | |
| 30 | function test_href() | |
| 31 | { | |
| 32 | $html = "<p><a href=\"\nhttp://test.com\n\">Firefox</a>"; | |
| 33 | ||
| 34 | $washer = new rcube_washtml; | |
| 35 | $washed = $washer->wash($html); | |
| 36 | ||
| 37 | $this->assertRegExp('|href="http://test.com">|', $washed, "Link href with newlines (#1488940)"); | |
| 38 | } | |
| 39 | ||
| 1e2468 | 40 | /** |
| AM | 41 | * Test handling HTML comments |
| 42 | */ | |
| 43 | function test_comments() | |
| 44 | { | |
| 45 | $washer = new rcube_washtml; | |
| 46 | ||
| 47 | $html = "<!--[if gte mso 10]><p>p1</p><!--><p>p2</p>"; | |
| 48 | $washed = $washer->wash($html); | |
| 49 | ||
| f77325 | 50 | $this->assertEquals('<!-- node type 8 --><!-- html ignored --><!-- body ignored --><p>p2</p>', $washed, "HTML conditional comments (#1489004)"); |
| 1e2468 | 51 | |
| AM | 52 | $html = "<!--TestCommentInvalid><p>test</p>"; |
| 53 | $washed = $washer->wash($html); | |
| 54 | ||
| 55 | $this->assertEquals('<!-- html ignored --><!-- body ignored --><p>test</p>', $washed, "HTML invalid comments (#1487759)"); | |
| 56 | } | |
| 57 | ||
| 7ac944 | 58 | } |
