mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-11-08 14:58:42 +00:00
Implement HTMLT tests, and migrate HTMLPurifierTest to this format.
HTMLT tests are a compact and easy-to-use way of making assertPurification type tests. They take the format of: --INI-- Ns.Directive = "directive value" --HTML-- Input HTML --EXPECT-- Expected HTML Expect more features and migration to be coming soon. Signed-off-by: Edward Z. Yang <edwardzyang@thewritingpot.com>
This commit is contained in:
parent
334ffac5b4
commit
e05bd77344
31
tests/HTMLPurifier/HTMLT.php
Normal file
31
tests/HTMLPurifier/HTMLT.php
Normal file
@ -0,0 +1,31 @@
|
||||
<?php
|
||||
|
||||
class HTMLPurifier_HTMLT extends HTMLPurifier_Harness
|
||||
{
|
||||
protected $path;
|
||||
|
||||
public function __construct($path) {
|
||||
$this->path = $path;
|
||||
parent::__construct($path);
|
||||
}
|
||||
|
||||
public function testHtmlt() {
|
||||
$parser = new HTMLPurifier_StringHashParser();
|
||||
$hash = $parser->parseFile($this->path); // assume parser normalizes to "\n"
|
||||
if (isset($hash['SKIPIF'])) {
|
||||
if (eval($hash['SKIPIF'])) return;
|
||||
}
|
||||
$this->config->set('Output', 'Newline', "\n");
|
||||
if (isset($hash['INI'])) {
|
||||
// there should be a more efficient way than writing another
|
||||
// ini file every time... probably means building a parser for
|
||||
// ini (check out the yaml implementation we saw somewhere else)
|
||||
$ini_file = $this->path . '.ini';
|
||||
file_put_contents($ini_file, $hash['INI']);
|
||||
$this->config->loadIni($ini_file);
|
||||
}
|
||||
$expect = isset($hash['EXPECT']) ? $hash['EXPECT'] : $hash['HTML'];
|
||||
$this->assertPurification(rtrim($hash['HTML']), rtrim($expect));
|
||||
if (isset($hash['INI'])) unlink($ini_file);
|
||||
}
|
||||
}
|
7
tests/HTMLPurifier/HTMLT/allowed-preserve.htmlt
Normal file
7
tests/HTMLPurifier/HTMLT/allowed-preserve.htmlt
Normal file
@ -0,0 +1,7 @@
|
||||
--INI--
|
||||
HTML.AllowedElements = b,i,p,a
|
||||
HTML.AllowedAttributes = a.href,*.id
|
||||
--HTML--
|
||||
<p>Par.</p>
|
||||
<p>Para<a href="http://google.com/">gr</a>aph</p>
|
||||
Text<b>Bol<i>d</i></b>
|
7
tests/HTMLPurifier/HTMLT/allowed-remove.htmlt
Normal file
7
tests/HTMLPurifier/HTMLT/allowed-remove.htmlt
Normal file
@ -0,0 +1,7 @@
|
||||
--INI--
|
||||
HTML.AllowedElements = b,i,p,a
|
||||
HTML.AllowedAttributes = a.href,*.id
|
||||
--HTML--
|
||||
<span>Not allowed</span><a class="mef" id="foobar">Remove id too!</a>
|
||||
--EXPECT--
|
||||
Not allowed<a>Remove id too!</a>
|
4
tests/HTMLPurifier/HTMLT/basic.htmlt
Normal file
4
tests/HTMLPurifier/HTMLT/basic.htmlt
Normal file
@ -0,0 +1,4 @@
|
||||
--HTML--
|
||||
<b>basic</b>
|
||||
--EXPECT--
|
||||
<b>basic</b>
|
5
tests/HTMLPurifier/HTMLT/blacklist-preserve.htmlt
Normal file
5
tests/HTMLPurifier/HTMLT/blacklist-preserve.htmlt
Normal file
@ -0,0 +1,5 @@
|
||||
--INI--
|
||||
HTML.ForbiddenElements = b
|
||||
HTML.ForbiddenAttributes = a@href
|
||||
--HTML--
|
||||
<p>foo</p>
|
7
tests/HTMLPurifier/HTMLT/blacklist-remove.htmlt
Normal file
7
tests/HTMLPurifier/HTMLT/blacklist-remove.htmlt
Normal file
@ -0,0 +1,7 @@
|
||||
--INI--
|
||||
HTML.ForbiddenElements = b
|
||||
HTML.ForbiddenAttributes = a@href
|
||||
--HTML--
|
||||
<b>Foo<a href="bar">bar</a></b>
|
||||
--EXPECT--
|
||||
Foo<a>bar</a>
|
4
tests/HTMLPurifier/HTMLT/css-allowed-preserve.htmlt
Normal file
4
tests/HTMLPurifier/HTMLT/css-allowed-preserve.htmlt
Normal file
@ -0,0 +1,4 @@
|
||||
--INI--
|
||||
CSS.AllowedProperties = color,background-color
|
||||
--HTML--
|
||||
<div style="color:#f00;background-color:#ded;">red</div>
|
6
tests/HTMLPurifier/HTMLT/css-allowed-remove.htmlt
Normal file
6
tests/HTMLPurifier/HTMLT/css-allowed-remove.htmlt
Normal file
@ -0,0 +1,6 @@
|
||||
--INI--
|
||||
CSS.AllowedProperties = color,background-color
|
||||
--HTML--
|
||||
<div style="color:#f00;border:1px solid #000">red</div>
|
||||
--EXPECT--
|
||||
<div style="color:#f00;">red</div>
|
5
tests/HTMLPurifier/HTMLT/disable-uri.htmlt
Normal file
5
tests/HTMLPurifier/HTMLT/disable-uri.htmlt
Normal file
@ -0,0 +1,5 @@
|
||||
--INI--
|
||||
URI.Disable = true
|
||||
--HTML--
|
||||
<img src="foobar" />
|
||||
--EXPECT--
|
6
tests/HTMLPurifier/HTMLT/empty.htmlt
Normal file
6
tests/HTMLPurifier/HTMLT/empty.htmlt
Normal file
@ -0,0 +1,6 @@
|
||||
--INI--
|
||||
|
||||
--HTML--
|
||||
|
||||
--EXPECT--
|
||||
|
4
tests/HTMLPurifier/HTMLT/id-default.htmlt
Normal file
4
tests/HTMLPurifier/HTMLT/id-default.htmlt
Normal file
@ -0,0 +1,4 @@
|
||||
--HTML--
|
||||
<span id="moon">foobar</span>
|
||||
--EXPECT--
|
||||
<span>foobar</span>
|
5
tests/HTMLPurifier/HTMLT/id-enabled.htmlt
Normal file
5
tests/HTMLPurifier/HTMLT/id-enabled.htmlt
Normal file
@ -0,0 +1,5 @@
|
||||
--INI--
|
||||
Attr.EnableID = true
|
||||
--HTML--
|
||||
<span id="moon">foobar</span>
|
||||
<img id="folly" src="folly.png" alt="Omigosh!" />
|
10
tests/HTMLPurifier/HTMLT/munge-extra.htmlt
Normal file
10
tests/HTMLPurifier/HTMLT/munge-extra.htmlt
Normal file
@ -0,0 +1,10 @@
|
||||
--INI--
|
||||
URI.Munge = "/redirect?s=%s&t=%t&r=%r&n=%n&m=%m&p=%p"
|
||||
URI.MungeSecretKey = "foo"
|
||||
URI.MungeResources = true
|
||||
--HTML--
|
||||
<a href="http://example.com">Link</a>
|
||||
<img src="http://example.com" style="background-image:url(http://example.com);" alt="example.com" />
|
||||
--EXPECT--
|
||||
<a href="/redirect?s=http%3A%2F%2Fexample.com&t=c15354f3953dfec262c55b1403067e0d045a3059&r=&n=a&m=href&p=">Link</a>
|
||||
<img src="/redirect?s=http%3A%2F%2Fexample.com&t=c15354f3953dfec262c55b1403067e0d045a3059&r=1&n=img&m=src&p=" style="background-image:url(/redirect?s=http%3A%2F%2Fexample.com&t=c15354f3953dfec262c55b1403067e0d045a3059&r=1&n=img&m=style&p=background-image);" alt="example.com" />
|
5
tests/HTMLPurifier/HTMLT/name.htmlt
Normal file
5
tests/HTMLPurifier/HTMLT/name.htmlt
Normal file
@ -0,0 +1,5 @@
|
||||
--INI--
|
||||
Attr.EnableID = true
|
||||
HTML.Doctype = "XHTML 1.0 Strict"
|
||||
--HTML--
|
||||
<a name="asdf"></a>
|
9
tests/HTMLPurifier/HTMLT/safe-object-embed-munge.htmlt
Normal file
9
tests/HTMLPurifier/HTMLT/safe-object-embed-munge.htmlt
Normal file
@ -0,0 +1,9 @@
|
||||
--INI--
|
||||
HTML.SafeObject = true
|
||||
HTML.SafeEmbed = true
|
||||
URI.Munge = "/redirect.php?url=%s&check=%t"
|
||||
URI.MungeSecretKey = "foo"
|
||||
--HTML--
|
||||
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
|
||||
--EXPECT--
|
||||
<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
|
7
tests/HTMLPurifier/HTMLT/safe-object-embed.htmlt
Normal file
7
tests/HTMLPurifier/HTMLT/safe-object-embed.htmlt
Normal file
@ -0,0 +1,7 @@
|
||||
--INI--
|
||||
HTML.SafeObject = true
|
||||
HTML.SafeEmbed = true
|
||||
--HTML--
|
||||
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
|
||||
--EXPECT--
|
||||
<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
|
8
tests/HTMLPurifier/HTMLT/script-bare.htmlt
Normal file
8
tests/HTMLPurifier/HTMLT/script-bare.htmlt
Normal file
@ -0,0 +1,8 @@
|
||||
--INI--
|
||||
HTML.Trusted = true
|
||||
--HTML--
|
||||
<script type="text/javascript">alert("<This is compatible with XHTML>");</script>
|
||||
--EXPECT--
|
||||
<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--><!]]></script>
|
10
tests/HTMLPurifier/HTMLT/script-cdata.htmlt
Normal file
10
tests/HTMLPurifier/HTMLT/script-cdata.htmlt
Normal file
@ -0,0 +1,10 @@
|
||||
--INI--
|
||||
HTML.Trusted = true
|
||||
--HTML--
|
||||
<script type="text/javascript"><![CDATA[
|
||||
alert("<This is compatible with XHTML>");
|
||||
]]></script>
|
||||
--EXPECT--
|
||||
<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--><!]]></script>
|
10
tests/HTMLPurifier/HTMLT/script-comment.htmlt
Normal file
10
tests/HTMLPurifier/HTMLT/script-comment.htmlt
Normal file
@ -0,0 +1,10 @@
|
||||
--INI--
|
||||
HTML.Trusted = true
|
||||
--HTML--
|
||||
<script type="text/javascript"><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--></script>
|
||||
--EXPECT--
|
||||
<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--><!]]></script>
|
10
tests/HTMLPurifier/HTMLT/script-dbl-comment.htmlt
Normal file
10
tests/HTMLPurifier/HTMLT/script-dbl-comment.htmlt
Normal file
@ -0,0 +1,10 @@
|
||||
--INI--
|
||||
HTML.Trusted = true
|
||||
--HTML--
|
||||
<script type="text/javascript"><![CDATA[
|
||||
alert("<This is compatible with XHTML>");
|
||||
//]]></script>
|
||||
--EXPECT--
|
||||
<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--><!]]></script>
|
10
tests/HTMLPurifier/HTMLT/script-ideal.htmlt
Normal file
10
tests/HTMLPurifier/HTMLT/script-ideal.htmlt
Normal file
@ -0,0 +1,10 @@
|
||||
--INI--
|
||||
HTML.Trusted = true
|
||||
--HTML--
|
||||
<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--><!]]></script>
|
||||
--EXPECT--
|
||||
<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--><!]]></script>
|
9
tests/HTMLPurifier/HTMLT/secure-munge.htmlt
Normal file
9
tests/HTMLPurifier/HTMLT/secure-munge.htmlt
Normal file
@ -0,0 +1,9 @@
|
||||
--INI--
|
||||
URI.Munge = "/redirect.php?url=%s&check=%t"
|
||||
URI.MungeSecretKey = "foo"
|
||||
--HTML--
|
||||
<a href="http://localhost">foo</a>
|
||||
<img src="http://localhost" alt="local" />
|
||||
--EXPECT--
|
||||
<a href="/redirect.php?url=http%3A%2F%2Flocalhost&check=8e8223ae8fac24561104180ea549c21fbd111be7">foo</a>
|
||||
<img src="http://localhost" alt="local" />
|
7
tests/HTMLPurifier/HTMLT/shift-jis-preserve-yen.htmlt
Normal file
7
tests/HTMLPurifier/HTMLT/shift-jis-preserve-yen.htmlt
Normal file
@ -0,0 +1,7 @@
|
||||
--SKIPIF--
|
||||
if (!function_exists('iconv')) return true;
|
||||
--INI--
|
||||
Core.Encoding = "Shift_JIS"
|
||||
Core.EscapeNonASCIICharacters = true
|
||||
--HTML--
|
||||
<b style="font-family:'¥';">111</b>
|
8
tests/HTMLPurifier/HTMLT/shift-jis-remove-yen.htmlt
Normal file
8
tests/HTMLPurifier/HTMLT/shift-jis-remove-yen.htmlt
Normal file
@ -0,0 +1,8 @@
|
||||
--SKIPIF--
|
||||
if (!function_exists('iconv')) return true;
|
||||
--INI--
|
||||
Core.Encoding = Shift_JIS
|
||||
--HTML--
|
||||
<b style="font-family:'¥';">111</b>
|
||||
--EXPECT--
|
||||
<b style="font-family:'';">111</b>
|
6
tests/HTMLPurifier/HTMLT/strict-blockquote.htmlt
Normal file
6
tests/HTMLPurifier/HTMLT/strict-blockquote.htmlt
Normal file
@ -0,0 +1,6 @@
|
||||
--INI--
|
||||
HTML.Strict = true
|
||||
--HTML--
|
||||
<blockquote>Illegal contents</blockquote>
|
||||
--EXPECT--
|
||||
<blockquote><p>Illegal contents</p></blockquote>
|
6
tests/HTMLPurifier/HTMLT/strict-underline.htmlt
Normal file
6
tests/HTMLPurifier/HTMLT/strict-underline.htmlt
Normal file
@ -0,0 +1,6 @@
|
||||
--INI--
|
||||
HTML.Strict = true
|
||||
--HTML--
|
||||
<u>Illegal underline</u>
|
||||
--EXPECT--
|
||||
<span style="text-decoration:underline;">Illegal underline</span>
|
@ -7,78 +7,7 @@ class HTMLPurifierTest extends HTMLPurifier_Harness
|
||||
function testNull() {
|
||||
$this->assertPurification("Null byte\0", "Null byte");
|
||||
}
|
||||
|
||||
function testStrict() {
|
||||
$this->config->set('HTML', 'Strict', true);
|
||||
|
||||
$this->assertPurification(
|
||||
'<u>Illegal underline</u>',
|
||||
'<span style="text-decoration:underline;">Illegal underline</span>'
|
||||
);
|
||||
|
||||
$this->assertPurification(
|
||||
'<blockquote>Illegal contents</blockquote>',
|
||||
'<blockquote><p>Illegal contents</p></blockquote>'
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
function testDifferentAllowedElements() {
|
||||
|
||||
$this->config->set('HTML', 'AllowedElements', array('b', 'i', 'p', 'a'));
|
||||
$this->config->set('HTML', 'AllowedAttributes', array('a.href', '*.id'));
|
||||
|
||||
$this->assertPurification(
|
||||
'<p>Par.</p><p>Para<a href="http://google.com/">gr</a>aph</p>Text<b>Bol<i>d</i></b>'
|
||||
);
|
||||
|
||||
$this->assertPurification(
|
||||
'<span>Not allowed</span><a class="mef" id="foobar">Foobar</a>',
|
||||
'Not allowed<a>Foobar</a>' // no ID!!!
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
function testBlacklistElements() {
|
||||
$this->config->set('HTML', 'ForbiddenElements', array('b'));
|
||||
$this->config->set('HTML', 'ForbiddenAttributes', array('a@href'));
|
||||
|
||||
$this->assertPurification(
|
||||
'<p>Par.</p>'
|
||||
);
|
||||
$this->assertPurification(
|
||||
'<b>Pa<a href="foo">r</a>.</b>',
|
||||
'Pa<a>r</a>.'
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
function testDifferentAllowedCSSProperties() {
|
||||
|
||||
$this->config->set('CSS', 'AllowedProperties', array('color', 'background-color'));
|
||||
|
||||
$this->assertPurification(
|
||||
'<div style="color:#f00;background-color:#ded;">red</div>'
|
||||
);
|
||||
|
||||
$this->assertPurification(
|
||||
'<div style="color:#f00;border:1px solid #000">red</div>',
|
||||
'<div style="color:#f00;">red</div>'
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
function testDisableURI() {
|
||||
|
||||
$this->config->set('URI', 'Disable', true);
|
||||
|
||||
$this->assertPurification(
|
||||
'<img src="foobar"/>',
|
||||
''
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
function test_purifyArray() {
|
||||
|
||||
$this->assertIdentical(
|
||||
@ -92,57 +21,6 @@ class HTMLPurifierTest extends HTMLPurifier_Harness
|
||||
|
||||
}
|
||||
|
||||
function testAttrIDDisabledByDefault() {
|
||||
|
||||
$this->assertPurification(
|
||||
'<span id="moon">foobar</span>',
|
||||
'<span>foobar</span>'
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
function testEnableAttrID() {
|
||||
$this->config->set('Attr', 'EnableID', true);
|
||||
$this->assertPurification('<span id="moon">foobar</span>');
|
||||
$this->assertPurification('<img id="folly" src="folly.png" alt="Omigosh!" />');
|
||||
}
|
||||
|
||||
function testScript() {
|
||||
$this->config->set('HTML', 'Trusted', true);
|
||||
|
||||
$ideal = '<script type="text/javascript"><!--//--><![CDATA[//><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--><!]]></script>';
|
||||
|
||||
$this->assertPurification($ideal);
|
||||
|
||||
$this->assertPurification(
|
||||
'<script type="text/javascript"><![CDATA[
|
||||
alert("<This is compatible with XHTML>");
|
||||
]]></script>',
|
||||
$ideal
|
||||
);
|
||||
|
||||
$this->assertPurification(
|
||||
'<script type="text/javascript">alert("<This is compatible with XHTML>");</script>',
|
||||
$ideal
|
||||
);
|
||||
|
||||
$this->assertPurification(
|
||||
'<script type="text/javascript"><!--
|
||||
alert("<This is compatible with XHTML>");
|
||||
//--></script>',
|
||||
$ideal
|
||||
);
|
||||
|
||||
$this->assertPurification(
|
||||
'<script type="text/javascript"><![CDATA[
|
||||
alert("<This is compatible with XHTML>");
|
||||
//]]></script>',
|
||||
$ideal
|
||||
);
|
||||
}
|
||||
|
||||
function testGetInstance() {
|
||||
$purifier = HTMLPurifier::getInstance();
|
||||
$purifier2 = HTMLPurifier::getInstance();
|
||||
@ -167,70 +45,5 @@ alert("<This is compatible with XHTML>");
|
||||
$this->purifier->purify('foo');
|
||||
}
|
||||
|
||||
function test_shiftJis() {
|
||||
if (!function_exists('iconv')) return;
|
||||
$this->config->set('Core', 'Encoding', 'Shift_JIS');
|
||||
$this->config->set('Core', 'EscapeNonASCIICharacters', true);
|
||||
$this->assertPurification(
|
||||
"<b style=\"font-family:'¥';\">111</b>"
|
||||
);
|
||||
}
|
||||
|
||||
function test_shiftJisWorstCase() {
|
||||
if (!function_exists('iconv')) return;
|
||||
$this->config->set('Core', 'Encoding', 'Shift_JIS');
|
||||
$this->assertPurification( // Notice how Yen disappears
|
||||
"<b style=\"font-family:'¥';\">111</b>",
|
||||
"<b style=\"font-family:'';\">111</b>"
|
||||
);
|
||||
}
|
||||
|
||||
function test_secureMunge() {
|
||||
$this->config->set('URI', 'Munge', '/redirect.php?url=%s&check=%t');
|
||||
$this->config->set('URI', 'MungeSecretKey', 'foo');
|
||||
$this->assertPurification(
|
||||
'<a href="http://localhost">foo</a><img src="http://localhost" alt="local" />',
|
||||
'<a href="/redirect.php?url=http%3A%2F%2Flocalhost&check=8e8223ae8fac24561104180ea549c21fbd111be7">foo</a><img src="http://localhost" alt="local" />'
|
||||
);
|
||||
}
|
||||
|
||||
function test_safeObjectAndEmbed() {
|
||||
$this->config->set('HTML', 'SafeObject', true);
|
||||
$this->config->set('HTML', 'SafeEmbed', true);
|
||||
$this->assertPurification(
|
||||
'<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>',
|
||||
'<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>'
|
||||
);
|
||||
}
|
||||
|
||||
function test_safeObjectAndEmbedWithSecureMunge() {
|
||||
$this->config->set('HTML', 'SafeObject', true);
|
||||
$this->config->set('HTML', 'SafeEmbed', true);
|
||||
$this->config->set('URI', 'Munge', '/redirect.php?url=%s&check=%t');
|
||||
$this->config->set('URI', 'MungeSecretKey', 'foo');
|
||||
$this->assertPurification(
|
||||
'<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>',
|
||||
'<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>'
|
||||
);
|
||||
}
|
||||
|
||||
function test_mungeWithExtraParams() {
|
||||
$this->config->set('URI', 'Munge', '/redirect?s=%s&t=%t&r=%r&n=%n&m=%m&p=%p');
|
||||
$this->config->set('URI', 'MungeSecretKey', 'foo');
|
||||
$this->config->set('URI', 'MungeResources', true);
|
||||
$this->assertPurification(
|
||||
'<a href="http://example.com">Link</a><img src="http://example.com" style="background-image:url(http://example.com);" alt="example.com" />',
|
||||
'<a href="/redirect?s=http%3A%2F%2Fexample.com&t=c15354f3953dfec262c55b1403067e0d045a3059&r=&n=a&m=href&p=">Link</a>'.
|
||||
'<img src="/redirect?s=http%3A%2F%2Fexample.com&t=c15354f3953dfec262c55b1403067e0d045a3059&r=1&n=img&m=src&p=" '.
|
||||
'style="background-image:url(/redirect?s=http%3A%2F%2Fexample.com&t=c15354f3953dfec262c55b1403067e0d045a3059&r=1&n=img&m=style&p=background-image);" alt="example.com" />'
|
||||
);
|
||||
}
|
||||
|
||||
function test_name() {
|
||||
$this->config->set('Attr', 'EnableID', true);
|
||||
$this->config->set('HTML', 'Doctype', 'XHTML 1.0 Strict');
|
||||
$this->assertPurification('<a name="asdf"></a>');
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
@ -161,6 +161,8 @@ function htmlpurifier_add_test($test, $test_file, $only_phpt = false) {
|
||||
return $test->add(path2class($test_file));
|
||||
case '.vtest':
|
||||
return $test->add(new HTMLPurifier_ConfigSchema_ValidatorTestCase($test_file));
|
||||
case '.htmlt':
|
||||
return $test->add(new HTMLPurifier_HTMLT($test_file));
|
||||
default:
|
||||
trigger_error("$test_file is an invalid file for testing", E_USER_ERROR);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user