Skip to content

Commit 7c717dc

Browse files
tburrytburry
committed
Merge pull request #3 from vanilla/feature/default-testing
Test default configurations for Htmlawed::filter()
2 parents e2fb832 + 3bbffaf commit 7c717dc

2 files changed

Lines changed: 158 additions & 6 deletions

File tree

‎src/Htmlawed.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,17 @@ class Htmlawed {
1313

1414
public static $defaultConfig = [
1515
'anti_link_spam' => ['`.`', ''],
16-
'comment' => 1,
16+
'balance' => 1,
1717
'cdata' => 3,
18-
'css_expression' => 1,
18+
'comment' => 1,
19+
'css_expression' => 0,
1920
'deny_attribute' => 'on*',
20-
'unique_ids' => 0,
21-
'elements' => '*-applet-form-input-textarea-iframe-script-style-embed-object',
21+
'direct_list_nest' => 1,
22+
'elements' => '*-applet-button-form-input-textarea-iframe-script-style-embed-object',
2223
'keep_bad' => 0,
2324
'schemes' => 'classid:clsid; href: aim, feed, file, ftp, gopher, http, https, irc, mailto, news, nntp, sftp, ssh, telnet; style: nil; *:file, http, https', // clsid allowed in class
25+
'unique_ids' => 0,
2426
'valid_xhtml' => 0,
25-
'direct_list_nest' => 1,
26-
'balance' => 1
2727
];
2828

2929
public static $defaultSpec = [

‎tests/DefaultsTest.php‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
<?php
2+
/**
3+
* @author Todd Burry <todd@vanillaforums.com>
4+
* @copyright 2009-2016 Vanilla Forums Inc.
5+
* @license Proprietary
6+
*/
7+
8+
namespace Htmlawed\Tests;
9+
10+
use Htmlawed;
11+
12+
/**
13+
* Test the default config and spec for {@link \Htmlawed::filter()}.
14+
*
15+
* Calling the HTML filter without overriding the config should offer reasonable protection.
16+
*/
17+
class DefaultsTest extends \PHPUnit_Framework_TestCase {
18+
protected function assertFiltered($expected, $html, $message = '') {
19+
$filtered = Htmlawed::filter($html);
20+
$this->assertSame($expected, $filtered, $message);
21+
}
22+
23+
24+
/**
25+
* Provide data for {@link testBalance()}
26+
*
27+
* @return array Returns a test array.
28+
*/
29+
public function provideBalanceTests() {
30+
return [
31+
['Hi <b>there', 'Hi <b>there</b>'],
32+
['<i>What <b>me</i> worry</b>', '<i>What <b>me</b></i> worry'],
33+
];
34+
}
35+
36+
/**
37+
* Test the **balance** config setting.
38+
*
39+
* @param string $html The HTML to filter.
40+
* @param string $expected The expected filtered HTML.
41+
* @dataProvider provideBalanceTests
42+
*/
43+
public function testBalance($html, $expected) {
44+
$this->assertFiltered($expected, $html);
45+
}
46+
47+
/**
48+
* Provide data for {@link testCommentRemoval()}
49+
*
50+
* @return array Returns a test array.
51+
*/
52+
public function provideCommentRemovalTests() {
53+
return [
54+
'normal' => ["<!-- comment -->\nNormal", "\nNormal"],
55+
'inline' => ["This is<!-- not --> it", "This is it"],
56+
'multiline' => ["<!-- Do\n it -->now", "now"]
57+
];
58+
}
59+
60+
/**
61+
* Test the **comment** config setting when it is set to remove comments.
62+
*
63+
* @param string $html The HTML to filter.
64+
* @param string $expected The expected filtered HTML.
65+
* @dataProvider provideCommentRemovalTests
66+
*/
67+
public function testCommentRemoval($html, $expected) {
68+
$filtered = Htmlawed::filter($html);
69+
$this->assertSame($expected, $filtered);
70+
}
71+
72+
/**
73+
* CSS expressions should be stripped by default.
74+
*/
75+
public function testCssExpressionStripping() {
76+
$html = '<span style="expression(alert(\'XSS\'))">foo</span>';
77+
$expected = '<span style=" (alert(\'XSS\'))">foo</span>';
78+
79+
$filtered = Htmlawed::filter($html);
80+
$this->assertSame($expected, $filtered);
81+
}
82+
83+
/**
84+
* Make sure that **deny_attribute** defaults to `on*`.
85+
*/
86+
public function testDenyAttribute() {
87+
$this->assertFiltered(
88+
'<div>...</div>',
89+
'<div onload="alert(\'XSS\')" onclick="die()">...</div>'
90+
);
91+
}
92+
93+
/**
94+
* Allow lists to be nested by default.
95+
*/
96+
public function testDirectNestList() {
97+
$html = <<<HTML
98+
<ul>
99+
<li>one</li>
100+
<ol>
101+
<li>two</li>
102+
</ol>
103+
</ul>
104+
HTML;
105+
$this->assertFiltered($html, $html);
106+
}
107+
108+
/**
109+
* Provide the elements for {@link testElements()}.
110+
*
111+
* @return array Returns an array for testing.
112+
*/
113+
public function provideInvalidElements() {
114+
$elements = explode('-', 'applet-button-form-input-textarea-iframe-script-style-embed-object');
115+
$result = [];
116+
foreach ($elements as $element) {
117+
$result[$element] = [$element];
118+
}
119+
return $result;
120+
}
121+
122+
/**
123+
* Test that default invalid elements are removed.
124+
*
125+
* @param string $element The element that should be removed.
126+
* @dataProvider provideInvalidElements
127+
*/
128+
public function testInvalidElements($element) {
129+
$html = "<div><$element>hi</$element></div>";
130+
$this->assertFiltered('<div>hi</div>', $html);
131+
}
132+
133+
/**
134+
* Test to make sure `javascript:` isn't allowed in an href.
135+
*/
136+
public function testBadScheme() {
137+
$this->assertFiltered(
138+
'<a rel="nofollow" href="denied:javascript:alert(\'xss\')">click</a>',
139+
'<a href="javascript:alert(\'xss\')">click</a>'
140+
);
141+
}
142+
143+
/**
144+
* Make sure duplicate ID checks aren't being done.
145+
*/
146+
public function testAllowDuplicateIDs() {
147+
$this->assertFiltered(
148+
'<b id="x">one</b><i id="x">two</i>',
149+
'<b id="x">one</b><i id="x">two</i>'
150+
);
151+
}
152+
}

0 commit comments

Comments
 (0)