mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2024-09-20 03:05:18 +00:00
f3d050c517
The first bug is that we will repeatedly write out the result of a customized raw definition to the filesystem, even when a cache entry already exists. The second bug is that caching these definitions doesn't actually work (the cache entry is written but never used.) A new API for retrieving raw definitions permits the user to take advantage of caching. Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
42 lines
1.7 KiB
PHP
42 lines
1.7 KiB
PHP
<?php
|
|
|
|
class HTMLPurifier_HTMLModule_SafeEmbedTest extends HTMLPurifier_HTMLModuleHarness
|
|
{
|
|
|
|
function setUp() {
|
|
parent::setUp();
|
|
$def = $this->config->getHTMLDefinition(true);
|
|
$def->manager->addModule('SafeEmbed');
|
|
}
|
|
|
|
function testMinimal() {
|
|
$this->assertResult(
|
|
'<embed src="http://www.youtube.com/v/RVtEQxH7PWA&hl=en" />',
|
|
'<embed src="http://www.youtube.com/v/RVtEQxH7PWA&hl=en" allowscriptaccess="never" allownetworking="internal" type="application/x-shockwave-flash" />'
|
|
);
|
|
}
|
|
|
|
function testYouTube() {
|
|
$this->assertResult(
|
|
'<embed src="http://www.youtube.com/v/RVtEQxH7PWA&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed>',
|
|
'<embed src="http://www.youtube.com/v/RVtEQxH7PWA&hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" />'
|
|
);
|
|
}
|
|
|
|
function testMalicious() {
|
|
$this->assertResult(
|
|
'<embed src="http://example.com/bad.swf" type="application/x-shockwave-flash" width="9999999" height="3499994" allowscriptaccess="always" allownetworking="always" />',
|
|
'<embed src="http://example.com/bad.swf" type="application/x-shockwave-flash" width="1200" height="1200" allowscriptaccess="never" allownetworking="internal" />'
|
|
);
|
|
}
|
|
|
|
function testFull() {
|
|
$this->assertResult(
|
|
'<b><embed src="http://www.youtube.com/v/RVtEQxH7PWA&hl=en" type="application/x-shockwave-flash" width="24" height="23" allowscriptaccess="never" allownetworking="internal" wmode="window" /></b>'
|
|
);
|
|
}
|
|
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|