Skip to content

Commit 73b86b5

Browse files
cswarecsware
authored
Increase test coverage (#314)
Signed-off-by: Sven Strickroth <[email protected]>
1 parent 62750d5 commit 73b86b5

File tree

3 files changed

+220
-0
lines changed

3 files changed

+220
-0
lines changed

‎src/test/java/org/owasp/html/CssSchemaTest.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,9 @@ public static final void testDangerousProperties() {
5555
// Prefix corner cases.
5656
"-",
5757
"-moz-",
58+
"-ms-",
59+
"-o-",
60+
"-webkit-",
5861
}) {
5962
assertSame(key, CssSchema.DISALLOWED, CssSchema.DEFAULT.forKey(key));
6063
}

‎src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,48 @@ public static final void testStyleFiltering() {
229229
.allowStandardUrlProtocols()));
230230
}
231231

232+
@Test
233+
public void testSpecificStyleFilterung() {
234+
assertEquals(
235+
Arrays.stream(new String[] {
236+
"<h1>Header</h1>",
237+
"<p>Paragraph 1</p>",
238+
"<p>Click me out</p>",
239+
"<p></p>",
240+
"<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
241+
"</p><p style=\"text-align:center\">Stylish Para 1</p>",
242+
"<p style=\"color:red\">Stylish Para 2</p>",
243+
""}).collect(Collectors.joining("\n")),
244+
apply(new HtmlPolicyBuilder()
245+
.allowCommonInlineFormattingElements()
246+
.allowCommonBlockElements()
247+
.allowStyling(CssSchema.withProperties(
248+
List.of("color", "text-align", "font-size")))
249+
.allowStandardUrlProtocols()));
250+
}
251+
252+
@Test
253+
public void testUnionStyleFilterung() {
254+
assertEquals(
255+
Arrays.stream(new String[] {
256+
"<h1>Header</h1>",
257+
"<p>Paragraph 1</p>",
258+
"<p>Click me out</p>",
259+
"<p></p>",
260+
"<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
261+
"</p><p style=\"text-align:center\">Stylish Para 1</p>",
262+
"<p style=\"color:red\">Stylish Para 2</p>",
263+
""}).collect(Collectors.joining("\n")),
264+
apply(new HtmlPolicyBuilder()
265+
.allowCommonInlineFormattingElements()
266+
.allowCommonBlockElements()
267+
.allowStyling(CssSchema.withProperties(
268+
List.of("color", "text-align")))
269+
.allowStyling( // union allowed style properties
270+
CssSchema.withProperties(List.of("font-size")))
271+
.allowStandardUrlProtocols()));
272+
}
273+
232274
@Test
233275
public static final void testElementTransforming() {
234276
assertEquals(
@@ -289,6 +331,25 @@ public static final void testAllowUrlProtocols() {
289331
.allowUrlProtocols("http")));
290332
}
291333

334+
@Test
335+
public static final void testDisallowUrlProtocols() {
336+
assertEquals(
337+
Arrays.stream(new String[] {
338+
"Header",
339+
"Paragraph 1",
340+
"Click me out",
341+
"<img src=\"canary.png\" alt=\"local-canary\" />",
342+
"Fancy with soupy tags.",
343+
"Stylish Para 1",
344+
"Stylish Para 2",
345+
""}).collect(Collectors.joining("\n")),
346+
apply(new HtmlPolicyBuilder()
347+
.allowElements("img")
348+
.allowAttributes("src", "alt").onElements("img")
349+
.allowUrlProtocols("http", "https")
350+
.disallowUrlProtocols("http")));
351+
}
352+
292353
@Test
293354
public static final void testPossibleFalloutFromIssue5() {
294355
assertEquals(
@@ -847,6 +908,52 @@ public static final void testEmptyDefaultLinkRelsSet() {
847908
pf.sanitize("<a href=\"http://example.com\" target=\"_blank\">eg</a>"));
848909
}
849910

911+
@Test
912+
public static final void testRequireAndSkipRels() {
913+
PolicyFactory pf = new HtmlPolicyBuilder()
914+
.allowElements("a")
915+
.allowAttributes("href", "target").onElements("a")
916+
.allowStandardUrlProtocols()
917+
.requireRelsOnLinks("noreferrer")
918+
.skipRelsOnLinks("noopener", "noreferrer")
919+
.toFactory();
920+
921+
assertEquals(
922+
"<a href=\"http://example.com\" target=\"_blank\">eg</a>",
923+
pf.sanitize("<a href=\"http://example.com\" target=\"_blank\">eg</a>"));
924+
925+
assertEquals(
926+
"<a href=\"http://example.com\" target=\"_blank\">eg</a>",
927+
pf.sanitize("<a href=\"http://example.com\" rel=noreferrer target=\"_blank\">eg</a>"));
928+
929+
assertEquals(
930+
"<a href=\"http://example.com\" target=\"_blank\">eg</a>",
931+
pf.sanitize("<a href=\"http://example.com\" rel=noopener target=\"_blank\">eg</a>"));
932+
}
933+
934+
@Test
935+
public static final void testSkipAndRequireRels() {
936+
PolicyFactory pf = new HtmlPolicyBuilder()
937+
.allowElements("a")
938+
.allowAttributes("href", "target").onElements("a")
939+
.allowStandardUrlProtocols()
940+
.skipRelsOnLinks("noopener", "noreferrer")
941+
.requireRelsOnLinks("noreferrer")
942+
.toFactory();
943+
944+
assertEquals(
945+
"<a href=\"http://example.com\" target=\"_blank\" rel=\"noreferrer\">eg</a>",
946+
pf.sanitize("<a href=\"http://example.com\" target=\"_blank\">eg</a>"));
947+
948+
assertEquals(
949+
"<a href=\"http://example.com\" target=\"_blank\" rel=\"noreferrer\">eg</a>",
950+
pf.sanitize("<a href=\"http://example.com\" rel=noreferrer target=\"_blank\">eg</a>"));
951+
952+
assertEquals(
953+
"<a href=\"http://example.com\" target=\"_blank\" rel=\"noreferrer\">eg</a>",
954+
pf.sanitize("<a href=\"http://example.com\" rel=noopener target=\"_blank\">eg</a>"));
955+
}
956+
850957
@Test
851958
public static final void testExplicitRelsSkip() {
852959
PolicyFactory pf = new HtmlPolicyBuilder()
@@ -913,6 +1020,64 @@ public static final void testDirLi() {
9131020
"<dir compact=\"compact\"><li>something</li></dir>"));
9141021
}
9151022

1023+
@Test
1024+
public void testDisallowTextIn() {
1025+
HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder()
1026+
.allowElements("div")
1027+
.allowAttributes("style").onElements("div");
1028+
1029+
PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory();
1030+
assertEquals("<div style=\"display:node\">Some Text</div>",
1031+
allowPolicy.sanitize("<div style=\"display:node\">Some Text</div>"));
1032+
1033+
PolicyFactory disallowTextPolicy =
1034+
sharedPolicyBuilder.disallowTextIn("div").toFactory();
1035+
assertEquals("<div style=\"display:node\"></div>",
1036+
disallowTextPolicy.sanitize(
1037+
"<div style=\"display:node\">Some Text</div>"));
1038+
}
1039+
1040+
@Test
1041+
public void testDisallowAttribute() {
1042+
HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder()
1043+
.allowElements("div", "p")
1044+
.allowAttributes("style").onElements("div", "p");
1045+
1046+
PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory();
1047+
assertEquals(
1048+
"<p style=\"display:node\">Some</p><div style=\"display:node\">Text</div>",
1049+
allowPolicy.sanitize(
1050+
"<p style=\"display:node\">Some</p><div style=\"display:node\">Text</div>"));
1051+
1052+
PolicyFactory disallowTextPolicy =
1053+
sharedPolicyBuilder.disallowAttributes("style").onElements("p").toFactory();
1054+
assertEquals("<p>Some</p><div style=\"display:node\">Text</div>",
1055+
disallowTextPolicy.sanitize(
1056+
"<p style=\"display:node\">Some</p><div style=\"display:node\">Text</div>"));
1057+
}
1058+
1059+
@Test
1060+
public void testCreativeCSSStyling() {
1061+
PolicyFactory policy = new HtmlPolicyBuilder()
1062+
.allowElements("p")
1063+
.allowAttributes("style").onElements("p").allowStyling().toFactory();
1064+
1065+
assertEquals("<p>Some</p>",
1066+
policy.sanitize("<p style=\"{display:none\">Some</p>"));
1067+
1068+
assertEquals("<p style=\"color:red\">Some</p>",
1069+
policy.sanitize("<p style=\"{display:none;};color:red\">Some</p>"));
1070+
1071+
assertEquals("<p style=\"color:red\">Some</p>",
1072+
policy.sanitize("<p style=\"{display:none;}color:red\">Some</p>"));
1073+
1074+
assertEquals("<p style=\"color:red\">Some</p>",
1075+
policy.sanitize("<p style=\"display:none }; color:red\">Some</p>"));
1076+
1077+
assertEquals("<p style=\"color:red\">Some</p>",
1078+
policy.sanitize("<p style=\"{display:none;}}color:red\">Some</p>"));
1079+
}
1080+
9161081
@Test
9171082
public static void testScriptTagWithCommentBlockContainingHtmlCommentEnd() {
9181083
PolicyFactory scriptSanitizer = new HtmlPolicyBuilder()

‎src/test/java/org/owasp/html/SanitizersTest.java‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,58 @@ public static final void testImages() {
157157
);
158158
}
159159

160+
@Test
161+
public static final void testIntegerAttributePolicy() {
162+
PolicyFactory s = Sanitizers.IMAGES;
163+
assertEquals(
164+
"<img src=\"x.png\" alt=\"y\" height=\"0\" border=\"0\" />",
165+
s.sanitize(
166+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=0 border=0>")
167+
);
168+
169+
assertEquals(
170+
"<img src=\"x.png\" alt=\"y\" height=\"069\" border=\"0\" />",
171+
s.sanitize(
172+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=069 border=0>")
173+
);
174+
175+
assertEquals(
176+
"<img src=\"x.png\" alt=\"y\" height=\"64\" border=\"0\" />",
177+
s.sanitize(
178+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=64.43 border=0>")
179+
);
180+
181+
assertEquals(
182+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
183+
s.sanitize(
184+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=-64 border=0>")
185+
);
186+
187+
assertEquals(
188+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
189+
s.sanitize(
190+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=\"\" border=0>")
191+
);
192+
193+
assertEquals(
194+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
195+
s.sanitize(
196+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=.43 border=0>")
197+
);
198+
199+
assertEquals(
200+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
201+
s.sanitize(
202+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=something border=0>")
203+
);
204+
205+
assertEquals(
206+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
207+
s.sanitize(
208+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=596thin border=0>")
209+
);
210+
}
211+
160212
@Test
161213
public static final void testLinks() {
162214
PolicyFactory s = Sanitizers.LINKS;

0 commit comments

Comments
 (0)