You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

318 lines
15 KiB

5 years ago
  1. <?php
  2. use Symfony\Component\HttpFoundation\Request;
  3. use Symfony\Component\HttpFoundation\Response;
  4. class SanitizeTest extends PHPUnit_Framework_TestCase {
  5. private $http;
  6. public function setUp() {
  7. $this->client = new Parse();
  8. $this->client->http = new p3k\HTTP\Test(dirname(__FILE__).'/data/');
  9. $this->client->mc = null;
  10. }
  11. private function parse($params) {
  12. $request = new Request($params);
  13. $response = new Response();
  14. return $this->client->parse($request, $response);
  15. }
  16. public function testAllowsWhitelistedTags() {
  17. $url = 'http://sanitize.example/entry-with-valid-tags';
  18. $response = $this->parse(['url' => $url]);
  19. $body = $response->getContent();
  20. $this->assertEquals(200, $response->getStatusCode());
  21. $data = json_decode($body, true);
  22. $html = $data['data']['content']['html'];
  23. $this->assertEquals('entry', $data['data']['type']);
  24. $this->assertContains('This content has only valid tags.', $html);
  25. $this->assertContains('<a href="http://sanitize.example/example">links</a>,', $html, '<a> missing');
  26. $this->assertContains('<abbr>abbreviations</abbr>,', $html, '<abbr> missing');
  27. $this->assertContains('<b>bold</b>,', $html, '<b> missing');
  28. $this->assertContains('<code>inline code</code>,', $html, '<code> missing');
  29. $this->assertContains('<del>delete</del>,', $html, '<del> missing');
  30. $this->assertContains('<em>emphasis</em>,', $html, '<em> missing');
  31. $this->assertContains('<i>italics</i>,', $html, '<i> missing');
  32. $this->assertContains('<img src="http://sanitize.example/example.jpg" alt="images are allowed" />', $html, '<img> missing');
  33. $this->assertContains('<q>inline quote</q>,', $html, '<q> missing');
  34. $this->assertContains('<strike>strikethrough</strike>,', $html, '<strike> missing');
  35. $this->assertContains('<strong>strong text</strong>,', $html, '<strong> missing');
  36. $this->assertContains('<time datetime="2016-01-01">time elements</time>', $html, '<time> missing');
  37. $this->assertContains('<blockquote>Blockquote tags are okay</blockquote>', $html);
  38. $this->assertContains('<pre>preformatted text is okay too', $html, '<pre> missing');
  39. $this->assertContains('for code examples and such</pre>', $html, '<pre> missing');
  40. $this->assertContains('<p>Paragraph tags are allowed</p>', $html, '<p> missing');
  41. $this->assertContains('<h1>One</h1>', $html, '<h1> missing');
  42. $this->assertContains('<h2>Two</h2>', $html, '<h2> missing');
  43. $this->assertContains('<h3>Three</h3>', $html, '<h3> missing');
  44. $this->assertContains('<h4>Four</h4>', $html, '<h4> missing');
  45. $this->assertContains('<h5>Five</h5>', $html, '<h5> missing');
  46. $this->assertContains('<h6>Six</h6>', $html, '<h6> missing');
  47. $this->assertContains('<ul>', $html, '<ul> missing');
  48. $this->assertContains('<li>One</li>', $html, '<li> missing');
  49. $this->assertContains('<p>We should allow<br />break<br />tags too</p>', $html, '<br> missing');
  50. }
  51. public function testRemovesUnsafeTags() {
  52. $url = 'http://sanitize.example/entry-with-unsafe-tags';
  53. $response = $this->parse(['url' => $url]);
  54. $body = $response->getContent();
  55. $this->assertEquals(200, $response->getStatusCode());
  56. $data = json_decode($body, true);
  57. $html = $data['data']['content']['html'];
  58. $text = $data['data']['content']['text'];
  59. $this->assertEquals('entry', $data['data']['type']);
  60. $this->assertNotContains('<script>', $html);
  61. $this->assertNotContains('<style>', $html);
  62. $this->assertNotContains('visiblity', $html); // from the CSS
  63. $this->assertNotContains('alert', $html); // from the JS
  64. $this->assertNotContains('visiblity', $text);
  65. $this->assertNotContains('alert', $text);
  66. }
  67. public function testAllowsMF2Classes() {
  68. $url = 'http://sanitize.example/entry-with-mf2-classes';
  69. $response = $this->parse(['url' => $url]);
  70. $body = $response->getContent();
  71. $this->assertEquals(200, $response->getStatusCode());
  72. $data = json_decode($body, true);
  73. $html = $data['data']['content']['html'];
  74. $this->assertEquals('entry', $data['data']['type']);
  75. $this->assertContains('<h2 class="p-name">Hello World</h2>', $html);
  76. $this->assertContains('<h3>Utility Class</h3>', $html);
  77. }
  78. public function testEscapingHTMLTagsInText() {
  79. $url = 'http://sanitize.example/html-escaping-in-text';
  80. $response = $this->parse(['url' => $url]);
  81. $body = $response->getContent();
  82. $this->assertEquals(200, $response->getStatusCode());
  83. $data = json_decode($body, true);
  84. $this->assertEquals('entry', $data['data']['type']);
  85. $this->assertEquals('This content has some HTML escaped entities such as & ampersand, " quote, escaped <code> HTML tags, an ümlaut, an @at sign.', $data['data']['content']['text']);
  86. }
  87. public function testEscapingHTMLTagsInHTML() {
  88. $url = 'http://sanitize.example/html-escaping-in-html';
  89. $response = $this->parse(['url' => $url]);
  90. $body = $response->getContent();
  91. $this->assertEquals(200, $response->getStatusCode());
  92. $data = json_decode($body, true);
  93. $this->assertEquals('entry', $data['data']['type']);
  94. $this->assertArrayNotHasKey('name', $data['data']);
  95. $this->assertEquals('This content has some HTML escaped entities such as & ampersand, " quote, escaped <code> HTML tags, an ümlaut, an @at sign.', $data['data']['content']['text']);
  96. $this->assertEquals('This content has some <i>HTML escaped</i> entities such as &amp; ampersand, " quote, escaped &lt;code&gt; HTML tags, an ümlaut, an @at sign.', $data['data']['content']['html']);
  97. }
  98. public function testSanitizeJavascriptURLs() {
  99. $url = 'http://sanitize.example/h-entry-with-javascript-urls';
  100. $response = $this->parse(['url' => $url]);
  101. $body = $response->getContent();
  102. $this->assertEquals(200, $response->getStatusCode());
  103. $data = json_decode($body, true);
  104. $this->assertEquals('entry', $data['data']['type']);
  105. $this->assertEquals('', $data['data']['author']['url']);
  106. $this->assertArrayNotHasKey('url', $data['data']);
  107. $this->assertArrayNotHasKey('photo', $data['data']);
  108. $this->assertArrayNotHasKey('audio', $data['data']);
  109. $this->assertArrayNotHasKey('video', $data['data']);
  110. $this->assertArrayNotHasKey('syndication', $data['data']);
  111. $this->assertArrayNotHasKey('in-reply-to', $data['data']);
  112. $this->assertArrayNotHasKey('like-of', $data['data']);
  113. $this->assertArrayNotHasKey('repost-of', $data['data']);
  114. $this->assertArrayNotHasKey('bookmark-of', $data['data']);
  115. $this->assertEquals('Author', $data['data']['author']['name']);
  116. $this->assertEquals('', $data['data']['author']['photo']);
  117. }
  118. public function testSanitizeEmailAuthorURL() {
  119. $url = 'http://sanitize.example/h-entry-with-email-author';
  120. $response = $this->parse(['url' => $url]);
  121. $body = $response->getContent();
  122. $this->assertEquals(200, $response->getStatusCode());
  123. $data = json_decode($body);
  124. $this->assertEquals('entry', $data->data->type);
  125. $this->assertEquals('', $data->data->author->url);
  126. $this->assertEquals('Author', $data->data->author->name);
  127. $this->assertEquals('http://sanitize.example/photo.jpg', $data->data->author->photo);
  128. }
  129. public function testPhotoInContentNoAlt() {
  130. // https://github.com/aaronpk/XRay/issues/52
  131. $url = 'http://sanitize.example/photo-in-content';
  132. $response = $this->parse(['url' => $url]);
  133. $body = $response->getContent();
  134. $this->assertEquals(200, $response->getStatusCode());
  135. $data = json_decode($body);
  136. $this->assertObjectNotHasAttribute('name', $data->data);
  137. $this->assertEquals('http://target.example.com/photo.jpg', $data->data->photo[0]);
  138. $this->assertEquals('This is a photo post with an img tag inside the content.', $data->data->content->text);
  139. $this->assertEquals('This is a photo post with an <code>img</code> tag inside the content.', $data->data->content->html);
  140. }
  141. /*
  142. // Commented out until #56 is resolved
  143. // https://github.com/aaronpk/XRay/issues/56
  144. public function testPhotoInTextContentNoAlt() {
  145. $url = 'http://sanitize.example/photo-in-text-content';
  146. $response = $this->parse(['url' => $url]);
  147. $body = $response->getContent();
  148. $this->assertEquals(200, $response->getStatusCode());
  149. $data = json_decode($body);
  150. $this->assertObjectNotHasAttribute('name', $data->data);
  151. $this->assertEquals('http://target.example.com/photo.jpg', $data->data->photo[0]);
  152. $this->assertEquals('This is a photo post with an img tag inside the content.', $data->data->content->text);
  153. $this->assertEquals('This is a photo post with an <code>img</code> tag inside the content.', $data->data->content->html);
  154. }
  155. */
  156. public function testPhotoInContentEmptyAltAttribute() {
  157. // https://github.com/aaronpk/XRay/issues/52
  158. $url = 'http://sanitize.example/photo-in-content-empty-alt';
  159. $response = $this->parse(['url' => $url]);
  160. $body = $response->getContent();
  161. $this->assertEquals(200, $response->getStatusCode());
  162. $data = json_decode($body);
  163. $this->assertObjectNotHasAttribute('name', $data->data);
  164. $this->assertEquals('http://target.example.com/photo.jpg', $data->data->photo[0]);
  165. $this->assertEquals('This is a photo post with an img tag inside the content.', $data->data->content->text);
  166. $this->assertEquals('This is a photo post with an <code>img</code> tag inside the content.', $data->data->content->html);
  167. }
  168. public function testPhotoInContentWithAlt() {
  169. // https://github.com/aaronpk/XRay/issues/52
  170. $url = 'http://sanitize.example/photo-in-content-with-alt';
  171. $response = $this->parse(['url' => $url]);
  172. $body = $response->getContent();
  173. $this->assertEquals(200, $response->getStatusCode());
  174. $data = json_decode($body);
  175. $this->assertObjectNotHasAttribute('name', $data->data);
  176. $this->assertEquals('http://target.example.com/photo.jpg', $data->data->photo[0]);
  177. $this->assertEquals('This is a photo post with an img tag inside the content.', $data->data->content->text);
  178. $this->assertEquals('This is a photo post with an <code>img</code> tag inside the content.', $data->data->content->html);
  179. }
  180. public function testPhotoInContentWithNoText() {
  181. $url = 'http://sanitize.example/cleverdevil';
  182. $response = $this->parse(['url' => $url]);
  183. $body = $response->getContent();
  184. $this->assertEquals(200, $response->getStatusCode());
  185. $data = json_decode($body);
  186. $this->assertObjectHasAttribute('name', $data->data);
  187. $this->assertEquals('Oh, how well they know me! 🥃', $data->data->name);
  188. $this->assertObjectNotHasAttribute('content', $data->data);
  189. $this->assertEquals('https://cleverdevil.io/file/5bf2fa91c3d4c592f9978200923cb56e/thumb.jpg', $data->data->photo[0]);
  190. }
  191. public function testPhotoWithDupeNameAndAlt1() {
  192. // https://github.com/aaronpk/XRay/issues/57
  193. $url = 'http://sanitize.example/photo-with-dupe-name-alt';
  194. $response = $this->parse(['url' => $url]);
  195. $body = $response->getContent();
  196. $this->assertEquals(200, $response->getStatusCode());
  197. $data = json_decode($body);
  198. $this->assertObjectHasAttribute('name', $data->data);
  199. $this->assertEquals('Photo caption', $data->data->name);
  200. $this->assertObjectNotHasAttribute('content', $data->data);
  201. $this->assertEquals('http://sanitize.example/photo.jpg', $data->data->photo[0]);
  202. }
  203. public function testPhotoWithDupeNameAndAlt2() {
  204. // This is simliar to adactio's markup
  205. // https://adactio.com/notes/13301
  206. $url = 'http://sanitize.example/photo-with-dupe-name-alt-2';
  207. $response = $this->parse(['url' => $url]);
  208. $body = $response->getContent();
  209. $this->assertEquals(200, $response->getStatusCode());
  210. $data = json_decode($body);
  211. $this->assertObjectHasAttribute('content', $data->data);
  212. $this->assertEquals('Photo caption', $data->data->content->text);
  213. $this->assertObjectNotHasAttribute('name', $data->data);
  214. $this->assertEquals('http://sanitize.example/photo.jpg', $data->data->photo[0]);
  215. }
  216. public function testPhotosWithAlt() {
  217. // https://github.com/microformats/microformats2-parsing/issues/16
  218. $url = 'http://sanitize.example/photos-with-alt';
  219. $response = $this->parse(['url' => $url]);
  220. $body = $response->getContent();
  221. $this->assertEquals(200, $response->getStatusCode());
  222. $data = json_decode($body);
  223. #print_r($data->data);
  224. $this->assertEquals('🌆 Made it to the first #NPSF #earlygang of the year, did in-betweeners abs, and 6:30 workout with a brutal burnout that was really its own workout. But wow pretty sunrise. Plus 50+ deg F? I’ll take it. #100PDPD'."\n\n".'#justshowup #darknesstodawn #wakeupthesun #fromwhereirun #NovemberProject #sunrise #latergram #nofilter', $data->data->content->text);
  225. $this->assertObjectNotHasAttribute('name', $data->data);
  226. $this->assertEquals('https://igx.4sqi.net/img/general/original/476_g7yruXflacsGr7PyVmECefyTBMB_R99zmPQxW7pftzA.jpg', $data->data->photo[0]);
  227. $this->assertEquals('https://igx.4sqi.net/img/general/original/476_zM3UgU9JHNhom907Ac_1WCEcUhGOJZaNWGlRmev86YA.jpg', $data->data->photo[1]);
  228. }
  229. /*
  230. // Commented out until #55 is resolved
  231. // https://github.com/aaronpk/XRay/issues/55
  232. public function testEntryWithImgNoImpliedPhoto() {
  233. // See https://github.com/microformats/microformats2-parsing/issues/6#issuecomment-357286985
  234. // and https://github.com/aaronpk/XRay/issues/52#issuecomment-357269683
  235. // and https://github.com/microformats/microformats2-parsing/issues/16
  236. $url = 'http://sanitize.example/entry-with-img-no-implied-photo';
  237. $response = $this->parse(['url' => $url]);
  238. $body = $response->getContent();
  239. $this->assertEquals(200, $response->getStatusCode());
  240. $data = json_decode($body);
  241. $this->assertObjectNotHasAttribute('photo', $data->data);
  242. $this->assertObjectNotHasAttribute('name', $data->data);
  243. $this->assertEquals('http://target.example.com/photo.jpg', $data->data->photo[0]);
  244. $this->assertEquals('This is a photo post with an img tag inside the content, which does not have a u-photo class so should not be removed.', $data->data->content->text);
  245. $this->assertEquals('This is a photo post with an <code>img</code> tag inside the content, which does not have a u-photo class so should not be removed. <img src="http://target.example.com/photo.jpg" alt="a photo">', $data->data->content->html);
  246. }
  247. */
  248. public function testWhitespaceWithBreakTags() {
  249. $url = 'http://sanitize.example/entry-with-br-tags';
  250. $response = $this->parse(['url' => $url]);
  251. $body = $response->getContent();
  252. $this->assertEquals(200, $response->getStatusCode());
  253. $data = json_decode($body);
  254. $this->assertEquals('This content has two break tags to indicate a paragraph break.<br /><br />This is how tantek\'s autolinker works.', $data->data->content->html);
  255. $this->assertEquals("This content has two break tags to indicate a paragraph break.\n\nThis is how tantek's autolinker works.", $data->data->content->text);
  256. }
  257. }