~tsep-dev/tsep/0.9-beta

$string = '<a href="http://www.badsite.com/phising"><img src="/img/test.jpg" alt="test image alt" title="test image title" id="myImage" class="image-left"/></a>';

326

$expected = '<a href="http://www.badsite.com/phising">test image alt</a><br />';

327

$result = Sanitize::stripImages($string);

328

$this->assertEqual($result, $expected);

329

330

$string = '<a onclick="medium()" href="http://example.com"><img src="foobar.png" onclick="evilFunction(); return false;"/></a>';

331

$expected = '<a onclick="medium()" href="http://example.com"></a>';

332

$result = Sanitize::stripImages($string);

333

$this->assertEqual($result, $expected);

334

}

335

336

/**

337

* testStripScripts method

338

339

* @access public

340

* @return void

341

342

function testStripScripts() {

343

$string = '<link href="/css/styles.css" media="screen" rel="stylesheet" />';

344

$expected = '';

345

$result = Sanitize::stripScripts($string);

346

$this->assertEqual($result, $expected);

347

348

$string = '<link href="/css/styles.css" media="screen" rel="stylesheet" />' . "\n" . '<link rel="icon" href="/favicon.ico" type="image/x-icon" />' . "\n" . '<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />' . "\n" . '<link rel="alternate" href="/feed.xml" title="RSS Feed" type="application/rss+xml" />';

349

$expected = "\n" . '<link rel="icon" href="/favicon.ico" type="image/x-icon" />' . "\n" . '<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />'."\n".'<link rel="alternate" href="/feed.xml" title="RSS Feed" type="application/rss+xml" />';

350

$result = Sanitize::stripScripts($string);

351

$this->assertEqual($result, $expected);

352

353

$string = '<script type="text/javascript"> alert("hacked!");</script>';

354

$expected = '';

355

$result = Sanitize::stripScripts($string);

356

$this->assertEqual($result, $expected);

357

358

$string = '<script> alert("hacked!");</script>';

359

$expected = '';

360

$result = Sanitize::stripScripts($string);

361

$this->assertEqual($result, $expected);

362

363

$string = '<style>#content { display:none; }</style>';

364

$expected = '';

365

$result = Sanitize::stripScripts($string);

366

$this->assertEqual($result, $expected);

367

368

$string = '<style type="text/css"></style>';

369

$expected = '';

370

$result = Sanitize::stripScripts($string);

371

$this->assertEqual($result, $expected);

372

373

$string = <<<HTML

374

text

375

376

<!--

377

#content { display:none; }

378

-->

379

</style>

380

text

381

HTML;

382

$expected = "text\n\ntext";

383

$result = Sanitize::stripScripts($string);

384

$this->assertEqual($result, $expected);

385

386

$string = <<<HTML

387

text

388

389

<!--

390

alert('wooo');

391

-->

392

</script>

393

text

394

HTML;

395

$expected = "text\n\ntext";

396

$result = Sanitize::stripScripts($string);

397

$this->assertEqual($result, $expected);

398

}

399

400

/**

401

* testStripAll method

402

403

* @access public

404

* @return void

405

406

function testStripAll() {

407

$string = '<img """><script>alert("xss")</script>"/>';

408

$expected ='"/>';

409

$result = Sanitize::stripAll($string);

410

$this->assertEqual($result, $expected);

411

412

$string = '<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>';

413

$expected = '';

414

$result = Sanitize::stripAll($string);

415

$this->assertEqual($result, $expected);

416

417

$string = '<<script>alert("XSS");//<</script>';

418

$expected = '<';

419

$result = Sanitize::stripAll($string);

420

$this->assertEqual($result, $expected);

421

422

$string = '<img src="http://google.com/images/logo.gif" onload="window.location=\'http://sam.com/\'" />'."\n".

423

"<p>This is ok \t\n text</p>\n".

424

'<link rel="stylesheet" href="/css/master.css" type="text/css" media="screen" title="my sheet" charset="utf-8">'."\n".

425

'<script src="xss.js" type="text/javascript" charset="utf-8"></script>';

426

$expected = '<p>This is ok text</p>';

427

$result = Sanitize::stripAll($string);

428

$this->assertEqual($result, $expected);

429

430

}

431

432

/**

433

* testStripTags method

434

435

* @access public

436

* @return void

437

438

function testStripTags() {

439

$string = '<h2>Headline</h2><p><a href="http://example.com">My Link</a> could go to a bad site</p>';

440

$expected = 'Headline<p>My Link could go to a bad site</p>';

441

$result = Sanitize::stripTags($string, 'h2', 'a');

442

$this->assertEqual($result, $expected);

443

444

$string = '<script type="text/javascript" src="http://evildomain.com"> </script>';

445

$expected = ' ';

446

$result = Sanitize::stripTags($string, 'script');

447

$this->assertEqual($result, $expected);

448

449

$string = '<h2>Important</h2><p>Additional information here <a href="/about"><img src="/img/test.png" /></a>. Read even more here</p>';

450

$expected = 'Important<p>Additional information here <img src="/img/test.png" />. Read even more here</p>';

451

$result = Sanitize::stripTags($string, 'h2', 'a');

452

$this->assertEqual($result, $expected);

453

454

$string = '<h2>Important</h2><p>Additional information here <a href="/about"><img src="/img/test.png" /></a>. Read even more here</p>';

455

$expected = 'Important<p>Additional information here . Read even more here</p>';

456

$result = Sanitize::stripTags($string, 'h2', 'a', 'img');

457

$this->assertEqual($result, $expected);

458

459

$string = '<b>Important message!</b><br>This message will self destruct!';

460

$expected = 'Important message!<br>This message will self destruct!';

461

$result = Sanitize::stripTags($string, 'b');

462

$this->assertEqual($result, $expected);

463

464

$string = '<b>Important message!</b><br />This message will self destruct!';

465

$expected = 'Important message!<br />This message will self destruct!';

466

$result = Sanitize::stripTags($string, 'b');

467

$this->assertEqual($result, $expected);

468

469

$string = '<h2 onclick="alert(\'evil\'); onmouseover="badness()">Important</h2><p>Additional information here <a href="/about"><img src="/img/test.png" /></a>. Read even more here</p>';

470

$expected = 'Important<p>Additional information here . Read even more here</p>';

471

$result = Sanitize::stripTags($string, 'h2', 'a', 'img');

472

$this->assertEqual($result, $expected);

473

}

474

475

/**

476

* testFormatColumns method

477

478

* @access public

479

* @return void

480

481

function testFormatColumns() {

482

$this->loadFixtures('DataTest', 'Article');

483

484

$this->DataTest =& new SanitizeDataTest(array('alias' => 'DataTest'));

485

$data = array('DataTest' => array(

486

'id' => 'z',

487

'count' => '12a',

488

'float' => '2.31456',

489

'updated' => '2008-01-01'

490

)

491

);

492

$this->DataTest->set($data);

493

$expected = array('DataTest' => array(

494

'id' => '0',

495

'count' => '12',

496

'float' => 2.31456,

497

'updated' => '2008-01-01 00:00:00',

498

));

499

Sanitize::formatColumns($this->DataTest);

500

$result = $this->DataTest->data;

501

$this->assertEqual($result, $expected);

502

503

$this->Article =& new SanitizeArticle(array('alias' => 'Article'));

504

$data = array('Article' => array(

505

'id' => 'ZB',

506

'user_id' => '12',

507

'title' => 'title of article',

508

'body' => 'body text',

509

'published' => 'QQQQQQQ',

510

));

511

$this->Article->set($data);

512

$expected = array('Article' => array(

513

'id' => '0',

514

'user_id' => '12',

515

'title' => 'title of article',

516

'body' => 'body text',

517

'published' => 'QQQQQQQ',

518

));

519

Sanitize::formatColumns($this->Article);

520

$result = $this->Article->data;

521

$this->assertEqual($result, $expected);

522

}

523

}

Older »