assertNormalized($value, $expected, $message);
}
/**
* Data provider for testFilterXssNormalized().
*
* @see testFilterXssNormalized()
*
* @return array
* An array of arrays containing strings:
* - The value to filter.
* - The value to expect after filtering.
* - The assertion message.
* - (optional) The allowed HTML HTML tags array that should be passed to
* \Drupal\Component\Utility\Xss::filter().
*/
public function providerTestFilterXssNormalized() {
return [
[
"Who's Online",
"who's online",
'HTML filter -- html entity number',
],
[
"Who's Online",
"who's online",
'HTML filter -- encoded html entity number',
],
[
"Who' Online",
"who' online",
'HTML filter -- double encoded html entity number',
],
// Custom elements with dashes in the tag name.
[
"",
"",
'Custom element with dashes in tag name.',
['test-element'],
],
];
}
/**
* Tests limiting to allowed tags and XSS prevention.
*
* XSS tests assume that script is disallowed by default and src is allowed
* by default, but on* and style attributes are disallowed.
*
* @param string $value
* The value to filter.
* @param string $expected
* The string that is expected to be missing.
* @param string $message
* The assertion message to display upon failure.
* @param array $allowed_tags
* (optional) The allowed HTML tags to be passed to \Drupal\Component\Utility\Xss::filter().
*
* @dataProvider providerTestFilterXssNotNormalized
*/
public function testFilterXssNotNormalized($value, $expected, $message, array $allowed_tags = NULL) {
if ($allowed_tags === NULL) {
$value = Xss::filter($value);
}
else {
$value = Xss::filter($value, $allowed_tags);
}
$this->assertNotNormalized($value, $expected, $message);
}
/**
* Data provider for testFilterXssNotNormalized().
*
* @see testFilterXssNotNormalized()
*
* @return array
* An array of arrays containing the following elements:
* - The value to filter.
* - The value to expect that's missing after filtering.
* - The assertion message.
* - (optional) The allowed HTML HTML tags array that should be passed to
* \Drupal\Component\Utility\Xss::filter().
*/
public function providerTestFilterXssNotNormalized() {
$cases = [
// Tag stripping, different ways to work around removal of HTML tags.
[
'',
'script',
'HTML tag stripping -- simple script without special characters.',
],
[
'',
'script',
'HTML tag stripping -- empty script with source.',
],
[
'',
'script',
'HTML tag stripping evasion -- non whitespace character after tag name.',
],
[
'',
'script',
'HTML tag stripping evasion -- no space between tag and attribute.',
],
// Null between < and tag name works at least with IE6.
[
"<\0scr\0ipt>alert(0)",
'ipt',
'HTML tag stripping evasion -- breaking HTML with nulls.',
],
[
"",
'script',
'HTML tag stripping evasion -- filter just removing "script".',
],
[
'<',
'script',
'HTML tag stripping evasion -- double opening brackets.',
],
[
'',
'script',
'HTML tag stripping evasion -- a malformed image tag.',
['img'],
],
[
'',
'script',
'HTML tag stripping evasion -- script in a blockqoute.',
['blockquote'],
],
[
"",
'script',
'HTML tag stripping evasion -- script within a comment.',
],
// Dangerous attributes removal.
[
'
",
'style',
'HTML filter -- invalid UTF-8.',
['p'],
],
];
// @fixme This dataset currently fails under 5.4 because of
// https://www.drupal.org/node/1210798. Restore after its fixed.
if (version_compare(PHP_VERSION, '5.4.0', '<')) {
$cases[] = [
'',
'javascript',
'HTML scheme clearing evasion -- spaces and metacharacters before scheme.',
['img'],
];
}
return $cases;
}
/**
* Checks that invalid multi-byte sequences are rejected.
*
* @param string $value
* The value to filter.
* @param string $expected
* The expected result.
* @param string $message
* The assertion message to display upon failure.
*
* @dataProvider providerTestInvalidMultiByte
*/
public function testInvalidMultiByte($value, $expected, $message) {
$this->assertEquals(Xss::filter($value), $expected, $message);
}
/**
* Data provider for testInvalidMultiByte().
*
* @see testInvalidMultiByte()
*
* @return array
* An array of arrays containing strings:
* - The value to filter.
* - The value to expect after filtering.
* - The assertion message.
*/
public function providerTestInvalidMultiByte() {
return [
["Foo\xC0barbaz", '', 'Xss::filter() accepted invalid sequence "Foo\xC0barbaz"'],
["Fooÿñ", "Fooÿñ", 'Xss::filter() rejects valid sequence Fooÿñ"'],
["\xc0aaa", '', 'HTML filter -- overlong UTF-8 sequences.'],
];
}
/**
* Checks that strings starting with a question sign are correctly processed.
*/
public function testQuestionSign() {
$value = Xss::filter('');
$this->assertTrue(stripos($value, 'assertEquals($expected, $value, $message);
}
/**
* Data provider for testFilterXssAdminNotNormalized().
*/
public function providerTestAttributes() {
return [
[
'',
'',
'Image tag with alt and title attribute',
['img']
],
[
'Drupal',
'Drupal',
'Link tag with rel attribute',
['a']
],
[
'Drupal 8: The best release ever.',
'Drupal 8: The best release ever.',
'Span tag with property attribute',
['span']
],
[
'',
'',
'Image tag with data attribute',
['img']
],
[
'',
'',
'Link tag with numeric data attribute',
['a']
],
];
}
/**
* Checks that \Drupal\Component\Utility\Xss::filterAdmin() correctly strips unallowed tags.
*/
public function testFilterXSSAdmin() {
$value = Xss::filterAdmin('
');
$this->assertEquals($value, '', 'Admin HTML filter -- should never allow some tags.');
}
/**
* Tests the loose, admin HTML filter.
*
* @param string $value
* The value to filter.
* @param string $expected
* The expected result.
* @param string $message
* The assertion message to display upon failure.
*
* @dataProvider providerTestFilterXssAdminNotNormalized
*/
public function testFilterXssAdminNotNormalized($value, $expected, $message) {
$this->assertNotNormalized(Xss::filterAdmin($value), $expected, $message);
}
/**
* Data provider for testFilterXssAdminNotNormalized().
*
* @see testFilterXssAdminNotNormalized()
*
* @return array
* An array of arrays containing strings:
* - The value to filter.
* - The value to expect after filtering.
* - The assertion message.
*/
public function providerTestFilterXssAdminNotNormalized() {
return [
// DRUPAL-SA-2008-044
['', 'object', 'Admin HTML filter -- should not allow object tag.'],
['', 'script', 'Admin HTML filter -- should not allow script tag.'],
];
}
/**
* Asserts that a text transformed to lowercase with HTML entities decoded does contain a given string.
*
* Otherwise fails the test with a given message, similar to all the
* SimpleTest assert* functions.
*
* Note that this does not remove nulls, new lines and other characters that
* could be used to obscure a tag or an attribute name.
*
* @param string $haystack
* Text to look in.
* @param string $needle
* Lowercase, plain text to look for.
* @param string $message
* (optional) Message to display if failed. Defaults to an empty string.
* @param string $group
* (optional) The group this message belongs to. Defaults to 'Other'.
*/
protected function assertNormalized($haystack, $needle, $message = '', $group = 'Other') {
$this->assertTrue(strpos(strtolower(Html::decodeEntities($haystack)), $needle) !== FALSE, $message, $group);
}
/**
* Asserts that text transformed to lowercase with HTML entities decoded does not contain a given string.
*
* Otherwise fails the test with a given message, similar to all the
* SimpleTest assert* functions.
*
* Note that this does not remove nulls, new lines, and other character that
* could be used to obscure a tag or an attribute name.
*
* @param string $haystack
* Text to look in.
* @param string $needle
* Lowercase, plain text to look for.
* @param string $message
* (optional) Message to display if failed. Defaults to an empty string.
* @param string $group
* (optional) The group this message belongs to. Defaults to 'Other'.
*/
protected function assertNotNormalized($haystack, $needle, $message = '', $group = 'Other') {
$this->assertTrue(strpos(strtolower(Html::decodeEntities($haystack)), $needle) === FALSE, $message, $group);
}
}
',
'