tests/HTMLPurifier/URISchemeTest.php

   1 <?php
   2
   3 // WARNING: All the URI schemes are far to relaxed, we need to tighten
   4 // the checks.
   5
   6 class HTMLPurifier_URISchemeTest extends HTMLPurifier_URIHarness
   7 {
   8
   9     private $pngBase64;
  10
  11     public function __construct() {
  12         $this->pngBase64 =
  13             'iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAABGdBTUEAALGP'.
  14             'C/xhBQAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9YGARc5KB0XV+IA'.
  15             'AAAddEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIFRoZSBHSU1Q72QlbgAAAF1J'.
  16             'REFUGNO9zL0NglAAxPEfdLTs4BZM4DIO4C7OwQg2JoQ9LE1exdlYvBBeZ7jq'.
  17             'ch9//q1uH4TLzw4d6+ErXMMcXuHWxId3KOETnnXXV6MJpcq2MLaI97CER3N0'.
  18             'vr4MkhoXe0rZigAAAABJRU5ErkJggg==';
  19     }
  20
  21     protected function assertValidation($uri, $expect_uri = true) {
  22         $this->prepareURI($uri, $expect_uri);
  23         $this->config->set('URI.AllowedSchemes', array($uri->scheme));
  24         // convenience hack: the scheme should be explicitly specified
  25         $scheme = $uri->getSchemeObj($this->config, $this->context);
  26         $result = $scheme->validate($uri, $this->config, $this->context);
  27         $this->assertEitherFailOrIdentical($result, $uri, $expect_uri);
  28     }
  29
  30     function test_http_regular() {
  31         $this->assertValidation(
  32             'http://example.com/?s=q#fragment'
  33         );
  34     }
  35
  36     function test_http_uppercase() {
  37         $this->assertValidation(
  38             'http://example.com/FOO'
  39         );
  40     }
  41
  42     function test_http_removeDefaultPort() {
  43         $this->assertValidation(
  44             'http://example.com:80',
  45             'http://example.com'
  46         );
  47     }
  48
  49     function test_http_removeUserInfo() {
  50         $this->assertValidation(
  51             'http://bob@example.com',
  52             'http://example.com'
  53         );
  54     }
  55
  56     function test_http_preserveNonDefaultPort() {
  57         $this->assertValidation(
  58             'http://example.com:8080'
  59         );
  60     }
  61
  62     function test_https_regular() {
  63         $this->assertValidation(
  64             'https://user@example.com:443/?s=q#frag',
  65             'https://example.com/?s=q#frag'
  66         );
  67     }
  68
  69     function test_ftp_regular() {
  70         $this->assertValidation(
  71             'ftp://user@example.com/path'
  72         );
  73     }
  74
  75     function test_ftp_removeDefaultPort() {
  76         $this->assertValidation(
  77             'ftp://example.com:21',
  78             'ftp://example.com'
  79         );
  80     }
  81
  82     function test_ftp_removeQueryString() {
  83         $this->assertValidation(
  84             'ftp://example.com?s=q',
  85             'ftp://example.com'
  86         );
  87     }
  88
  89     function test_ftp_preserveValidTypecode() {
  90         $this->assertValidation(
  91             'ftp://example.com/file.txt;type=a'
  92         );
  93     }
  94
  95     function test_ftp_removeInvalidTypecode() {
  96         $this->assertValidation(
  97             'ftp://example.com/file.txt;type=z',
  98             'ftp://example.com/file.txt'
  99         );
 100     }
 101
 102     function test_ftp_encodeExtraSemicolons() {
 103         $this->assertValidation(
 104             'ftp://example.com/too;many;semicolons=1',
 105             'ftp://example.com/too%3Bmany%3Bsemicolons=1'
 106         );
 107     }
 108
 109     function test_news_regular() {
 110         $this->assertValidation(
 111             'news:gmane.science.linguistics'
 112         );
 113     }
 114
 115     function test_news_explicit() {
 116         $this->assertValidation(
 117             'news:642@eagle.ATT.COM'
 118         );
 119     }
 120
 121     function test_news_removeNonPathComponents() {
 122         $this->assertValidation(
 123             'news://user@example.com:80/rec.music?path=foo#frag',
 124             'news:/rec.music#frag'
 125         );
 126     }
 127
 128     function test_nntp_regular() {
 129         $this->assertValidation(
 130             'nntp://news.example.com/alt.misc/42#frag'
 131         );
 132     }
 133
 134     function test_nntp_removalOfRedundantOrUselessComponents() {
 135         $this->assertValidation(
 136             'nntp://user@news.example.com:119/alt.misc/42?s=q#frag',
 137             'nntp://news.example.com/alt.misc/42#frag'
 138         );
 139     }
 140
 141     function test_mailto_regular() {
 142         $this->assertValidation(
 143             'mailto:bob@example.com'
 144         );
 145     }
 146
 147     function test_mailto_removalOfRedundantOrUselessComponents() {
 148         $this->assertValidation(
 149             'mailto://user@example.com:80/bob@example.com?subject=Foo#frag',
 150             'mailto:/bob@example.com?subject=Foo#frag'
 151         );
 152     }
 153
 154     function test_data_png() {
 155         $this->assertValidation(
 156             'data:image/png;base64,'.$this->pngBase64
 157         );
 158     }
 159
 160     function test_data_malformed() {
 161         $this->assertValidation(
 162             'data:image/png;base64,vr4MkhoXJRU5ErkJggg==',
 163             false
 164         );
 165     }
 166
 167     function test_data_implicit() {
 168         $this->assertValidation(
 169             'data:base64,'.$this->pngBase64,
 170             'data:image/png;base64,'.$this->pngBase64
 171         );
 172     }
 173
 174     function test_file_basic() {
 175         $this->assertValidation(
 176             'file://user@MYCOMPUTER:12/foo/bar?baz#frag',
 177             'file://MYCOMPUTER/foo/bar#frag'
 178         );
 179     }
 180
 181     function test_file_local() {
 182         $this->assertValidation(
 183             'file:///foo/bar?baz#frag',
 184             'file:///foo/bar#frag'
 185         );
 186     }
 187
 188     function test_ftp_empty_host() {
 189         $this->assertValidation('ftp:///example.com', false);
 190     }
 191
 192 }
 193
 194 // vim: et sw=4 sts=4