2015-11-19 15:18:13 +00:00
|
|
|
require 'spec_helper'
|
|
|
|
|
2017-07-10 14:24:02 +00:00
|
|
|
describe Banzai::Filter::SanitizationFilter do
|
2015-11-19 15:18:13 +00:00
|
|
|
include FilterSpecHelper
|
|
|
|
|
|
|
|
describe 'default whitelist' do
|
|
|
|
it 'sanitizes tags that are not whitelisted' do
|
|
|
|
act = %q{<textarea>no inputs</textarea> and <blink>no blinks</blink>}
|
|
|
|
exp = 'no inputs and no blinks'
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'sanitizes tag attributes' do
|
|
|
|
act = %q{<a href="http://example.com/bar.html" onclick="bar">Text</a>}
|
|
|
|
exp = %q{<a href="http://example.com/bar.html">Text</a>}
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'sanitizes javascript in attributes' do
|
|
|
|
act = %q(<a href="javascript:alert('foo')">Text</a>)
|
|
|
|
exp = '<a>Text</a>'
|
2016-05-07 17:56:08 +00:00
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'sanitizes mixed-cased javascript in attributes' do
|
|
|
|
act = %q(<a href="javaScript:alert('foo')">Text</a>)
|
|
|
|
exp = '<a>Text</a>'
|
2015-11-19 15:18:13 +00:00
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'allows whitelisted HTML tags from the user' do
|
|
|
|
exp = act = "<dl>\n<dt>Term</dt>\n<dd>Definition</dd>\n</dl>"
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'sanitizes `class` attribute on any element' do
|
|
|
|
act = %q{<strong class="foo">Strong</strong>}
|
|
|
|
expect(filter(act).to_html).to eq %q{<strong>Strong</strong>}
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'sanitizes `id` attribute on any element' do
|
|
|
|
act = %q{<em id="foo">Emphasis</em>}
|
|
|
|
expect(filter(act).to_html).to eq %q{<em>Emphasis</em>}
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
describe 'custom whitelist' do
|
|
|
|
it 'customizes the whitelist only once' do
|
|
|
|
instance = described_class.new('Foo')
|
2017-09-22 15:54:35 +00:00
|
|
|
control_count = instance.whitelist[:transformers].size
|
|
|
|
|
2015-11-19 15:18:13 +00:00
|
|
|
3.times { instance.whitelist }
|
|
|
|
|
2017-09-22 15:54:35 +00:00
|
|
|
expect(instance.whitelist[:transformers].size).to eq control_count
|
2015-11-19 15:18:13 +00:00
|
|
|
end
|
|
|
|
|
2018-07-24 19:58:31 +00:00
|
|
|
it 'customizes the whitelist only once for different instances' do
|
|
|
|
instance1 = described_class.new('Foo1')
|
|
|
|
instance2 = described_class.new('Foo2')
|
|
|
|
control_count = instance1.whitelist[:transformers].size
|
|
|
|
|
|
|
|
instance1.whitelist
|
|
|
|
instance2.whitelist
|
|
|
|
|
|
|
|
expect(instance1.whitelist[:transformers].size).to eq control_count
|
|
|
|
expect(instance2.whitelist[:transformers].size).to eq control_count
|
|
|
|
end
|
|
|
|
|
2017-04-02 17:39:41 +00:00
|
|
|
it 'sanitizes `class` attribute from all elements' do
|
|
|
|
act = %q{<pre class="code highlight white c"><code><span class="k">def</span></code></pre>}
|
|
|
|
exp = %q{<pre><code><span class="k">def</span></code></pre>}
|
2015-11-19 15:18:13 +00:00
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'sanitizes `class` attribute from non-highlight spans' do
|
|
|
|
act = %q{<span class="k">def</span>}
|
|
|
|
expect(filter(act).to_html).to eq %q{<span>def</span>}
|
|
|
|
end
|
|
|
|
|
2017-08-31 15:27:34 +00:00
|
|
|
it 'allows `text-align` property in `style` attribute on table elements' do
|
|
|
|
html = <<~HTML
|
2015-11-19 15:18:13 +00:00
|
|
|
<table>
|
|
|
|
<tr><th style="text-align: center">Head</th></tr>
|
|
|
|
<tr><td style="text-align: right">Body</th></tr>
|
|
|
|
</table>
|
|
|
|
HTML
|
|
|
|
|
|
|
|
doc = filter(html)
|
|
|
|
|
|
|
|
expect(doc.at_css('th')['style']).to eq 'text-align: center'
|
|
|
|
expect(doc.at_css('td')['style']).to eq 'text-align: right'
|
|
|
|
end
|
|
|
|
|
2017-08-31 15:27:34 +00:00
|
|
|
it 'disallows other properties in `style` attribute on table elements' do
|
|
|
|
html = <<~HTML
|
|
|
|
<table>
|
|
|
|
<tr><th style="text-align: foo">Head</th></tr>
|
|
|
|
<tr><td style="position: fixed; height: 50px; width: 50px; background: red; z-index: 999; font-size: 36px; text-align: center">Body</th></tr>
|
|
|
|
</table>
|
|
|
|
HTML
|
|
|
|
|
|
|
|
doc = filter(html)
|
|
|
|
|
|
|
|
expect(doc.at_css('th')['style']).to be_nil
|
|
|
|
expect(doc.at_css('td')['style']).to eq 'text-align: center'
|
|
|
|
end
|
|
|
|
|
2018-06-15 12:05:26 +00:00
|
|
|
it 'disallows `text-align` property in `style` attribute on other elements' do
|
|
|
|
html = <<~HTML
|
|
|
|
<div style="text-align: center">Text</div>
|
|
|
|
HTML
|
|
|
|
|
|
|
|
doc = filter(html)
|
|
|
|
|
|
|
|
expect(doc.at_css('div')['style']).to be_nil
|
|
|
|
end
|
|
|
|
|
2015-11-19 15:18:13 +00:00
|
|
|
it 'allows `span` elements' do
|
|
|
|
exp = act = %q{<span>Hello</span>}
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
2016-01-22 12:47:14 +00:00
|
|
|
it 'allows `abbr` elements' do
|
|
|
|
exp = act = %q{<abbr title="HyperText Markup Language">HTML</abbr>}
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
2017-09-22 15:51:09 +00:00
|
|
|
it 'disallows the `name` attribute globally, allows on `a`' do
|
2017-08-30 17:34:34 +00:00
|
|
|
html = <<~HTML
|
|
|
|
<img name="getElementById" src="">
|
|
|
|
<span name="foo" class="bar">Hi</span>
|
2017-09-22 15:51:09 +00:00
|
|
|
<a name="foo" class="bar">Bye</a>
|
2017-08-30 17:34:34 +00:00
|
|
|
HTML
|
|
|
|
|
|
|
|
doc = filter(html)
|
|
|
|
|
|
|
|
expect(doc.at_css('img')).not_to have_attribute('name')
|
|
|
|
expect(doc.at_css('span')).not_to have_attribute('name')
|
2017-09-22 15:51:09 +00:00
|
|
|
expect(doc.at_css('a')).to have_attribute('name')
|
2017-08-30 17:34:34 +00:00
|
|
|
end
|
|
|
|
|
2016-09-28 11:46:11 +00:00
|
|
|
it 'allows `summary` elements' do
|
|
|
|
exp = act = '<summary>summary line</summary>'
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'allows `details` elements' do
|
|
|
|
exp = act = '<details>long text goes here</details>'
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
2017-05-09 12:14:24 +00:00
|
|
|
it 'allows `data-math-style` attribute on `code` and `pre` elements' do
|
|
|
|
html = <<-HTML
|
|
|
|
<pre class="code" data-math-style="inline">something</pre>
|
|
|
|
<code class="code" data-math-style="inline">something</code>
|
|
|
|
<div class="code" data-math-style="inline">something</div>
|
|
|
|
HTML
|
|
|
|
|
|
|
|
output = <<-HTML
|
|
|
|
<pre data-math-style="inline">something</pre>
|
|
|
|
<code data-math-style="inline">something</code>
|
|
|
|
<div>something</div>
|
|
|
|
HTML
|
|
|
|
|
|
|
|
expect(filter(html).to_html).to eq(output)
|
|
|
|
end
|
|
|
|
|
2015-11-19 15:18:13 +00:00
|
|
|
it 'removes `rel` attribute from `a` elements' do
|
|
|
|
act = %q{<a href="#" rel="nofollow">Link</a>}
|
|
|
|
exp = %q{<a href="#">Link</a>}
|
|
|
|
|
|
|
|
expect(filter(act).to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
# Adapted from the Sanitize test suite: http://git.io/vczrM
|
|
|
|
protocols = {
|
|
|
|
'protocol-based JS injection: simple, no spaces' => {
|
|
|
|
input: '<a href="javascript:alert(\'XSS\');">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: simple, spaces before' => {
|
|
|
|
input: '<a href="javascript :alert(\'XSS\');">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: simple, spaces after' => {
|
|
|
|
input: '<a href="javascript: alert(\'XSS\');">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: simple, spaces before and after' => {
|
|
|
|
input: '<a href="javascript : alert(\'XSS\');">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: preceding colon' => {
|
|
|
|
input: '<a href=":javascript:alert(\'XSS\');">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: UTF-8 encoding' => {
|
|
|
|
input: '<a href="javascript:">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: long UTF-8 encoding' => {
|
|
|
|
input: '<a href="javascript:">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: long UTF-8 encoding without semicolons' => {
|
|
|
|
input: '<a href=javascript:alert('XSS')>foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: hex encoding' => {
|
|
|
|
input: '<a href="javascript:">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: long hex encoding' => {
|
|
|
|
input: '<a href="javascript:">foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: hex encoding without semicolons' => {
|
|
|
|
input: '<a href=javascript:alert('XSS')>foo</a>',
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
|
|
|
'protocol-based JS injection: null char' => {
|
|
|
|
input: "<a href=java\0script:alert(\"XSS\")>foo</a>",
|
|
|
|
output: '<a href="java"></a>'
|
|
|
|
},
|
|
|
|
|
2016-03-14 20:07:51 +00:00
|
|
|
'protocol-based JS injection: invalid URL char' => {
|
|
|
|
input: '<img src=java\script:alert("XSS")>',
|
|
|
|
output: '<img>'
|
|
|
|
},
|
|
|
|
|
2017-10-17 10:12:24 +00:00
|
|
|
'protocol-based JS injection: Unicode' => {
|
|
|
|
input: %Q(<a href="\u0001java\u0003script:alert('XSS')">foo</a>),
|
|
|
|
output: '<a>foo</a>'
|
|
|
|
},
|
|
|
|
|
2015-11-19 15:18:13 +00:00
|
|
|
'protocol-based JS injection: spaces and entities' => {
|
|
|
|
input: '<a href="  javascript:alert(\'XSS\');">foo</a>',
|
2019-01-05 02:54:02 +00:00
|
|
|
output: '<a href="">foo</a>'
|
2015-11-19 15:18:13 +00:00
|
|
|
},
|
2016-03-14 20:07:51 +00:00
|
|
|
|
|
|
|
'protocol whitespace' => {
|
|
|
|
input: '<a href=" http://example.com/"></a>',
|
|
|
|
output: '<a href="http://example.com/"></a>'
|
|
|
|
}
|
2015-11-19 15:18:13 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
protocols.each do |name, data|
|
2016-02-21 22:33:35 +00:00
|
|
|
it "disallows #{name}" do
|
2015-11-19 15:18:13 +00:00
|
|
|
doc = filter(data[:input])
|
|
|
|
|
|
|
|
expect(doc.to_html).to eq data[:output]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-02-21 22:33:35 +00:00
|
|
|
it 'disallows data links' do
|
|
|
|
input = '<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">XSS</a>'
|
|
|
|
output = filter(input)
|
|
|
|
|
|
|
|
expect(output.to_html).to eq '<a>XSS</a>'
|
|
|
|
end
|
|
|
|
|
2016-02-24 01:40:31 +00:00
|
|
|
it 'disallows vbscript links' do
|
|
|
|
input = '<a href="vbscript:alert(document.domain)">XSS</a>'
|
|
|
|
output = filter(input)
|
|
|
|
|
|
|
|
expect(output.to_html).to eq '<a>XSS</a>'
|
|
|
|
end
|
|
|
|
|
2016-03-14 20:07:51 +00:00
|
|
|
it 'disallows invalid URIs' do
|
2017-06-21 13:48:12 +00:00
|
|
|
expect(Addressable::URI).to receive(:parse).with('foo://example.com')
|
|
|
|
.and_raise(Addressable::URI::InvalidURIError)
|
2016-03-14 20:07:51 +00:00
|
|
|
|
|
|
|
input = '<a href="foo://example.com">Foo</a>'
|
|
|
|
output = filter(input)
|
|
|
|
|
|
|
|
expect(output.to_html).to eq '<a>Foo</a>'
|
|
|
|
end
|
|
|
|
|
2015-11-19 15:18:13 +00:00
|
|
|
it 'allows non-standard anchor schemes' do
|
|
|
|
exp = %q{<a href="irc://irc.freenode.net/git">IRC</a>}
|
|
|
|
act = filter(exp)
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'allows relative links' do
|
|
|
|
exp = %q{<a href="foo/bar.md">foo/bar.md</a>}
|
|
|
|
act = filter(exp)
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
2019-01-05 02:54:02 +00:00
|
|
|
|
2018-12-21 02:22:27 +00:00
|
|
|
it 'allows the `data-sourcepos` attribute globally' do
|
|
|
|
exp = %q{<p data-sourcepos="1:1-1:10">foo/bar.md</p>}
|
|
|
|
act = filter(exp)
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
2019-01-05 02:54:02 +00:00
|
|
|
describe 'footnotes' do
|
2019-01-17 03:13:44 +00:00
|
|
|
it 'allows correct footnote id property on links' do
|
2019-01-05 02:54:02 +00:00
|
|
|
exp = %q{<a href="#fn1" id="fnref1">foo/bar.md</a>}
|
|
|
|
act = filter(exp)
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
2019-01-17 03:13:44 +00:00
|
|
|
it 'allows correct footnote id property on li element' do
|
2019-01-05 02:54:02 +00:00
|
|
|
exp = %q{<ol><li id="fn1">footnote</li></ol>}
|
|
|
|
act = filter(exp)
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
|
|
|
|
2019-01-17 03:13:44 +00:00
|
|
|
it 'removes invalid id for footnote links' do
|
2019-01-05 02:54:02 +00:00
|
|
|
exp = %q{<a href="#fn1">link</a>}
|
|
|
|
|
|
|
|
%w[fnrefx test xfnref1].each do |id|
|
|
|
|
act = filter(%Q{<a href="#fn1" id="#{id}">link</a>})
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2019-01-17 03:13:44 +00:00
|
|
|
it 'removes invalid id for footnote li' do
|
2019-01-05 02:54:02 +00:00
|
|
|
exp = %q{<ol><li>footnote</li></ol>}
|
|
|
|
|
|
|
|
%w[fnx test xfn1].each do |id|
|
|
|
|
act = filter(%Q{<ol><li id="#{id}">footnote</li></ol>})
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
|
|
|
end
|
2019-01-10 23:28:44 +00:00
|
|
|
|
|
|
|
it 'allows footnotes numbered higher than 9' do
|
|
|
|
exp = %q{<a href="#fn15" id="fnref15">link</a><ol><li id="fn15">footnote</li></ol>}
|
|
|
|
act = filter(exp)
|
|
|
|
|
|
|
|
expect(act.to_html).to eq exp
|
|
|
|
end
|
2019-01-05 02:54:02 +00:00
|
|
|
end
|
2015-11-19 15:18:13 +00:00
|
|
|
end
|
|
|
|
end
|