You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

116 lines
5.4 KiB

8 years ago
  1. <?php
  2. use Symfony\Component\HttpFoundation\Request;
  3. use Symfony\Component\HttpFoundation\Response;
  4. class SanitizeTest extends PHPUnit_Framework_TestCase {
  5. private $http;
  6. public function setUp() {
  7. $this->client = new Parse();
  8. $this->client->http = new p3k\HTTPTest(dirname(__FILE__).'/data/');
  9. }
  10. private function parse($params) {
  11. $request = new Request($params);
  12. $response = new Response();
  13. return $this->client->parse($request, $response);
  14. }
  15. public function testAllowsWhitelistedTags() {
  16. $url = 'http://sanitize.example/entry-with-valid-tags';
  17. $response = $this->parse(['url' => $url]);
  18. $body = $response->getContent();
  19. $this->assertEquals(200, $response->getStatusCode());
  20. $data = json_decode($body, true);
  21. $html = $data['data']['content']['html'];
  22. $this->assertEquals('entry', $data['data']['type']);
  23. $this->assertContains('This content has only valid tags.', $html);
  24. $this->assertContains('<a href="http://sanitize.example/example">links</a>,', $html, '<a> missing');
  25. $this->assertContains('<abbr>abbreviations</abbr>,', $html, '<abbr> missing');
  26. $this->assertContains('<b>bold</b>,', $html, '<b> missing');
  27. $this->assertContains('<code>inline code</code>,', $html, '<code> missing');
  28. $this->assertContains('<del>delete</del>,', $html, '<del> missing');
  29. $this->assertContains('<em>emphasis</em>,', $html, '<em> missing');
  30. $this->assertContains('<i>italics</i>,', $html, '<i> missing');
  31. $this->assertContains('<img alt="images are allowed" src="http://sanitize.example/example.jpg" />', $html, '<img> missing');
  32. $this->assertContains('<q>inline quote</q>,', $html, '<q> missing');
  33. $this->assertContains('<strike>strikethrough</strike>,', $html, '<strike> missing');
  34. $this->assertContains('<strong>strong text</strong>,', $html, '<strong> missing');
  35. $this->assertContains('<time datetime="2016-01-01">time elements</time>', $html, '<time> missing');
  36. $this->assertContains('<blockquote>Blockquote tags are okay</blockquote>', $html);
  37. $this->assertContains('<pre>preformatted text is okay too', $html, '<pre> missing');
  38. $this->assertContains('for code examples and such</pre>', $html, '<pre> missing');
  39. $this->assertContains('<p>Paragraph tags are allowed</p>', $html, '<p> missing');
  40. $this->assertContains('<h1>One</h1>', $html, '<h1> missing');
  41. $this->assertContains('<h2>Two</h2>', $html, '<h2> missing');
  42. $this->assertContains('<h3>Three</h3>', $html, '<h3> missing');
  43. $this->assertContains('<h4>Four</h4>', $html, '<h4> missing');
  44. $this->assertContains('<h5>Five</h5>', $html, '<h5> missing');
  45. $this->assertContains('<h6>Six</h6>', $html, '<h6> missing');
  46. $this->assertContains('<ul>', $html, '<ul> missing');
  47. $this->assertContains('<li>One</li>', $html, '<li> missing');
  48. }
  49. public function testRemovesUnsafeTags() {
  50. $url = 'http://sanitize.example/entry-with-unsafe-tags';
  51. $response = $this->parse(['url' => $url]);
  52. $body = $response->getContent();
  53. $this->assertEquals(200, $response->getStatusCode());
  54. $data = json_decode($body, true);
  55. $html = $data['data']['content']['html'];
  56. $text = $data['data']['content']['text'];
  57. $this->assertEquals('entry', $data['data']['type']);
  58. $this->assertNotContains('<script>', $html);
  59. $this->assertNotContains('<style>', $html);
  60. $this->assertNotContains('visiblity', $html); // from the CSS
  61. $this->assertNotContains('alert', $html); // from the JS
  62. $this->assertNotContains('visiblity', $text);
  63. $this->assertNotContains('alert', $text);
  64. }
  65. public function testAllowsMF2Classes() {
  66. $url = 'http://sanitize.example/entry-with-mf2-classes';
  67. $response = $this->parse(['url' => $url]);
  68. $body = $response->getContent();
  69. $this->assertEquals(200, $response->getStatusCode());
  70. $data = json_decode($body, true);
  71. $html = $data['data']['content']['html'];
  72. $this->assertEquals('entry', $data['data']['type']);
  73. $this->assertContains('<h2 class="p-name">Hello World</h2>', $html);
  74. $this->assertContains('<h3>Utility Class</h3>', $html);
  75. }
  76. public function testEscapingHTMLTagsInText() {
  77. $url = 'http://sanitize.example/html-escaping-in-text';
  78. $response = $this->parse(['url' => $url]);
  79. $body = $response->getContent();
  80. $this->assertEquals(200, $response->getStatusCode());
  81. $data = json_decode($body, true);
  82. $this->assertEquals('entry', $data['data']['type']);
  83. $this->assertEquals('This content has some HTML escaped entities such as & ampersand, " quote, escaped <code> HTML tags, an ümlaut, an @at sign.', $data['data']['content']['text']);
  84. }
  85. public function testEscapingHTMLTagsInHTML() {
  86. $url = 'http://sanitize.example/html-escaping-in-html';
  87. $response = $this->parse(['url' => $url]);
  88. $body = $response->getContent();
  89. $this->assertEquals(200, $response->getStatusCode());
  90. $data = json_decode($body, true);
  91. $this->assertEquals('entry', $data['data']['type']);
  92. $this->assertArrayNotHasKey('name', $data['data']);
  93. $this->assertEquals('This content has some HTML escaped entities such as & ampersand, " quote, escaped <code> HTML tags, an ümlaut, an @at sign.', $data['data']['content']['text']);
  94. $this->assertEquals('This content has some <i>HTML escaped</i> entities such as &amp; ampersand, " quote, escaped &lt;code&gt; HTML tags, an ümlaut, an @at sign.', $data['data']['content']['html']);
  95. }
  96. }