From fc52af24f1418d6590a2d37a0d8cc31b123e38f6 Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Tue, 19 Aug 2014 12:08:35 -0400
Subject: [PATCH] Fix merge error that disabled contact drag'n'drop
---
tests/MailFunc.php | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++-
1 files changed, 51 insertions(+), 1 deletions(-)
diff --git a/tests/MailFunc.php b/tests/MailFunc.php
index 967277c..3a5a6fe 100644
--- a/tests/MailFunc.php
+++ b/tests/MailFunc.php
@@ -97,6 +97,20 @@
}
/**
+ * Test the elimination of some XSS vulnerabilities
+ */
+ function test_html_xss3()
+ {
+ // #1488850
+ $html = '<p><a href="data:text/html,<script>alert(document.cookie)</script>">Firefox</a>'
+ .'<a href="vbscript:alert(document.cookie)">Internet Explorer</a></p>';
+ $washed = rcmail_wash_html($html, array('safe' => true), array());
+
+ $this->assertNotRegExp('/data:text/', $washed, "Remove data:text/html links");
+ $this->assertNotRegExp('/vbscript:/', $washed, "Remove vbscript: links");
+ }
+
+ /**
* Test washtml class on non-unicode characters (#1487813)
*/
function test_washtml_utf8()
@@ -159,7 +173,7 @@
function test_resolve_base()
{
$html = file_get_contents(TESTS_DIR . 'src/htmlbase.txt');
- $html = rcmail_resolve_base($html);
+ $html = rcube_washtml::resolve_base($html);
$this->assertRegExp('|src="http://alec\.pl/dir/img1\.gif"|', $html, "URI base resolving [1]");
$this->assertRegExp('|src="http://alec\.pl/dir/img2\.gif"|', $html, "URI base resolving [2]");
@@ -169,4 +183,40 @@
$this->assertRegExp('|src="cid:theCID"|', $html, "URI base resolving exception [1]");
$this->assertRegExp('|src="http://other\.domain\.tld/img3\.gif"|', $html, "URI base resolving exception [2]");
}
+
+ /**
+ * Test identities selection using Return-Path header
+ */
+ function test_rcmail_identity_select()
+ {
+ $identities = array(
+ array(
+ 'name' => 'Test',
+ 'email_ascii' => 'addr@domain.tld',
+ 'ident' => 'Test <addr@domain.tld>',
+ ),
+ array(
+ 'name' => 'Test',
+ 'email_ascii' => 'thing@domain.tld',
+ 'ident' => 'Test <thing@domain.tld>',
+ ),
+ array(
+ 'name' => 'Test',
+ 'email_ascii' => 'other@domain.tld',
+ 'ident' => 'Test <other@domain.tld>',
+ ),
+ );
+
+ $message = new stdClass;
+ $message->headers = new rcube_message_header;
+ $message->headers->set('Return-Path', '<some_thing@domain.tld>');
+ $res = rcmail_identity_select($message, $identities);
+
+ $this->assertSame($identities[0], $res);
+
+ $message->headers->set('Return-Path', '<thing@domain.tld>');
+ $res = rcmail_identity_select($message, $identities);
+
+ $this->assertSame($identities[1], $res);
+ }
}
--
Gitblit v1.9.1