| | |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertEquals('<!-- html ignored --><!-- body ignored --><p>test</p>', $washed, "HTML invalid comments (#1487759)"); |
|---|
| | | |
|---|
| | | $html = "<p>para1</p><!-- comment --><p>para2</p>"; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><!-- node type 8 --><p>para2</p>', $washed, "HTML comments - simple comment"); |
|---|
| | | |
|---|
| | | $html = "<p>para1</p><!-- <hr> comment --><p>para2</p>"; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertEquals('<!-- html ignored --><!-- body ignored --><p>para1</p><!-- node type 8 --><p>para2</p>', $washed, "HTML comments - tags inside (#1489904)"); |
|---|
| | | } |
|---|
| | | |
|---|
| | | /** |
|---|
| | |
|---|
| | | function test_style_unicode() |
|---|
| | | { |
|---|
| | | $html = "<html><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /> |
|---|
| | | <body><span style='font-family:\"新細明體\",\"serif\";color:red'>令全場爆滿</span></body></html>"; |
|---|
| | | <body><span style='font-family:\"新細明體\",\"serif\";color:red'>test</span></body></html>"; |
|---|
| | | |
|---|
| | | $washer = new rcube_washtml; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertRegExp('|style=\'font-family: "新細明體","serif"; color: red\'|', $washed, "Unicode chars in style attribute (#1489697)"); |
|---|
| | | $this->assertRegExp('|style="font-family: \"新細明體\",\"serif\"; color: red"|', $washed, "Unicode chars in style attribute - quoted (#1489697)"); |
|---|
| | | |
|---|
| | | $html = "<html><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /> |
|---|
| | | <body><span style='font-family:新細明體;color:red'>test</span></body></html>"; |
|---|
| | | |
|---|
| | | $washer = new rcube_washtml; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertRegExp('|style="font-family: 新細明體; color: red"|', $washed, "Unicode chars in style attribute (#1489697)"); |
|---|
| | | } |
|---|
| | | |
|---|
| | | /** |
|---|
| | | * Test style item fixes |
|---|
| | | */ |
|---|
| | | function test_style_wash() |
|---|
| | | { |
|---|
| | | $html = "<p style=\"line-height: 1; height: 10\">a</p>"; |
|---|
| | | |
|---|
| | | $washer = new rcube_washtml; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertRegExp('|line-height: 1;|', $washed, "Untouched line-height (#1489917)"); |
|---|
| | | $this->assertRegExp('|; height: 10px|', $washed, "Fixed height units"); |
|---|
| | | |
|---|
| | | $html = "<div style=\"padding: 0px\n 20px;border:1px solid #000;\"></div>"; |
|---|
| | | $expected = "<div style=\"padding: 0px 20px; border: 1px solid #000\"></div>"; |
|---|
| | | |
|---|
| | | $washer = new rcube_washtml; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertTrue(strpos($washed, $expected) !== false, "White-space and new-line characters handling"); |
|---|
| | | } |
|---|
| | | |
|---|
| | | /** |
|---|
| | | * Test invalid style cleanup - XSS prevention (#1490227) |
|---|
| | | */ |
|---|
| | | function test_style_wash_xss() |
|---|
| | | { |
|---|
| | | $html = "<img style=aaa:'\"/onerror=alert(1)//'>"; |
|---|
| | | $exp = "<img style=\"aaa: '"/onerror=alert(1)//'\" />"; |
|---|
| | | |
|---|
| | | $washer = new rcube_washtml; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)"); |
|---|
| | | |
|---|
| | | $html = "<img style=aaa:'"/onerror=alert(1)//'>"; |
|---|
| | | $exp = "<img style=\"aaa: '"/onerror=alert(1)//'\" />"; |
|---|
| | | |
|---|
| | | $washer = new rcube_washtml; |
|---|
| | | $washed = $washer->wash($html); |
|---|
| | | |
|---|
| | | $this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)"); |
|---|
| | | } |
|---|
| | | } |
|---|
