tests/HTMLPurifier/URIFilter/MungeTest.php

   1 <?php
   2
   3 class HTMLPurifier_URIFilter_MungeTest extends HTMLPurifier_URIFilterHarness
   4 {
   5
   6     public function setUp()
   7     {
   8         parent::setUp();
   9         $this->filter = new HTMLPurifier_URIFilter_Munge();
  10     }
  11
  12     protected function setMunge($uri = 'http://www.google.com/url?q=%s')
  13     {
  14         $this->config->set('URI.Munge', $uri);
  15     }
  16
  17     protected function setSecureMunge($key = 'secret')
  18     {
  19         if (!function_exists('hash_hmac')) return false;
  20         $this->setMunge('/redirect.php?url=%s&checksum=%t');
  21         $this->config->set('URI.MungeSecretKey', $key);
  22         return true;
  23     }
  24
  25     public function testMunge()
  26     {
  27         $this->setMunge();
  28         $this->assertFiltering(
  29             'http://www.example.com/',
  30             'http://www.google.com/url?q=http%3A%2F%2Fwww.example.com%2F'
  31         );
  32     }
  33
  34     public function testMungeReplaceTagName()
  35     {
  36         $this->setMunge('/r?tagname=%n&url=%s');
  37         $token = new HTMLPurifier_Token_Start('a');
  38         $this->context->register('CurrentToken', $token);
  39         $this->assertFiltering('http://google.com', '/r?tagname=a&url=http%3A%2F%2Fgoogle.com');
  40     }
  41
  42     public function testMungeReplaceAttribute()
  43     {
  44         $this->setMunge('/r?attr=%m&url=%s');
  45         $attr = 'href';
  46         $this->context->register('CurrentAttr', $attr);
  47         $this->assertFiltering('http://google.com', '/r?attr=href&url=http%3A%2F%2Fgoogle.com');
  48     }
  49
  50     public function testMungeReplaceResource()
  51     {
  52         $this->setMunge('/r?embeds=%r&url=%s');
  53         $embeds = false;
  54         $this->context->register('EmbeddedURI', $embeds);
  55         $this->assertFiltering('http://google.com', '/r?embeds=&url=http%3A%2F%2Fgoogle.com');
  56     }
  57
  58     public function testMungeReplaceCSSProperty()
  59     {
  60         $this->setMunge('/r?property=%p&url=%s');
  61         $property = 'background';
  62         $this->context->register('CurrentCSSProperty', $property);
  63         $this->assertFiltering('http://google.com', '/r?property=background&url=http%3A%2F%2Fgoogle.com');
  64     }
  65
  66     public function testIgnoreEmbedded()
  67     {
  68         $this->setMunge();
  69         $embeds = true;
  70         $this->context->register('EmbeddedURI', $embeds);
  71         $this->assertFiltering('http://example.com');
  72     }
  73
  74     public function testProcessEmbedded()
  75     {
  76         $this->setMunge();
  77         $this->config->set('URI.MungeResources', true);
  78         $embeds = true;
  79         $this->context->register('EmbeddedURI', $embeds);
  80         $this->assertFiltering('http://www.example.com/', 'http://www.google.com/url?q=http%3A%2F%2Fwww.example.com%2F');
  81     }
  82
  83     public function testPreserveRelative()
  84     {
  85         $this->setMunge();
  86         $this->assertFiltering('index.html');
  87     }
  88
  89     public function testMungeIgnoreUnknownSchemes()
  90     {
  91         $this->setMunge();
  92         $this->assertFiltering('javascript:foobar();', true);
  93     }
  94
  95     public function testSecureMungePreserve()
  96     {
  97         if (!$this->setSecureMunge()) return;
  98         $this->assertFiltering('/local');
  99     }
 100
 101     public function testSecureMungePreserveEmbedded()
 102     {
 103         if (!$this->setSecureMunge()) return;
 104         $embedded = true;
 105         $this->context->register('EmbeddedURI', $embedded);
 106         $this->assertFiltering('http://google.com');
 107     }
 108
 109     public function testSecureMungeStandard()
 110     {
 111         if (!$this->setSecureMunge()) return;
 112         $this->assertFiltering('http://google.com', '/redirect.php?url=http%3A%2F%2Fgoogle.com&checksum=46267a796aca0ea5839f24c4c97ad2648373a4eca31b1c0d1fa7c7ff26798f79');
 113     }
 114
 115     public function testSecureMungeIgnoreUnknownSchemes()
 116     {
 117         // This should be integration tested as well to be false
 118         if (!$this->setSecureMunge()) return;
 119         $this->assertFiltering('javascript:', true);
 120     }
 121
 122     public function testSecureMungeIgnoreUnbrowsableSchemes()
 123     {
 124         if (!$this->setSecureMunge()) return;
 125         $this->assertFiltering('news:', true);
 126     }
 127
 128     public function testSecureMungeToDirectory()
 129     {
 130         if (!$this->setSecureMunge()) return;
 131         $this->setMunge('/links/%s/%t');
 132         $this->assertFiltering('http://google.com', '/links/http%3A%2F%2Fgoogle.com/46267a796aca0ea5839f24c4c97ad2648373a4eca31b1c0d1fa7c7ff26798f79');
 133     }
 134
 135     public function testMungeIgnoreSameDomain()
 136     {
 137         $this->setMunge('http://example.com/%s');
 138         $this->assertFiltering('http://example.com/foobar');
 139     }
 140
 141     public function testMungeIgnoreSameDomainInsecureToSecure()
 142     {
 143         $this->setMunge('http://example.com/%s');
 144         $this->assertFiltering('https://example.com/foobar');
 145     }
 146
 147     public function testMungeIgnoreSameDomainSecureToSecure()
 148     {
 149         $this->config->set('URI.Base', 'https://example.com');
 150         $this->setMunge('http://example.com/%s');
 151         $this->assertFiltering('https://example.com/foobar');
 152     }
 153
 154     public function testMungeSameDomainSecureToInsecure()
 155     {
 156         $this->config->set('URI.Base', 'https://example.com');
 157         $this->setMunge('/%s');
 158         $this->assertFiltering('http://example.com/foobar', '/http%3A%2F%2Fexample.com%2Ffoobar');
 159     }
 160
 161     public function testMungeIgnoresSourceHost()
 162     {
 163         $this->config->set('URI.Host', 'foo.example.com');
 164         $this->setMunge('http://example.com/%s');
 165         $this->assertFiltering('http://foo.example.com/bar');
 166     }
 167
 168 }
 169
 170 // vim: et sw=4 sts=4