2 /* vim: set expandtab sw=4 ts=4 sts=4: */
4 * Tests for methods in Sanitize class
6 * @package PhpMyAdmin-test
8 declare(strict_types
=1);
10 namespace PhpMyAdmin\Tests
;
12 use PhpMyAdmin\Sanitize
;
13 use PHPUnit\Framework\TestCase
;
16 * Tests for methods in Sanitize class
18 * @package PhpMyAdmin-test
20 class SanitizeTest
extends TestCase
23 * Tests for proper escaping of XSS.
27 public function testXssInHref()
30 '[a@javascript:alert(\'XSS\');@target]link</a>',
31 Sanitize
::sanitizeMessage('[a@javascript:alert(\'XSS\');@target]link[/a]')
36 * Tests correct generating of link redirector.
40 public function testLink()
42 $lang = $GLOBALS['lang'];
44 unset($GLOBALS['server']);
45 unset($GLOBALS['lang']);
47 '<a href="./url.php?url=https%3A%2F%2Fwww.phpmyadmin.net%2F" target="target">link</a>',
48 Sanitize
::sanitizeMessage('[a@https://www.phpmyadmin.net/@target]link[/a]')
51 $GLOBALS['lang'] = $lang;
55 * Tests links to documentation.
57 * @param string $link link
58 * @param string $expected expected result
62 * @dataProvider docLinks
64 public function testDoc($link, $expected): void
67 '<a href="./url.php?url=https%3A%2F%2Fdocs.phpmyadmin.net%2Fen%2Flatest%2F' . $expected . '" target="documentation">doclink</a>',
68 Sanitize
::sanitizeMessage('[doc@' . $link . ']doclink[/doc]')
73 * Data provider for sanitize [doc@foo] markup
77 public function docLinks()
86 'config.html%23cfg_TitleTable',
100 * Tests link target validation.
104 public function testInvalidTarget()
107 '[a@./Documentation.html@INVALID9]doc</a>',
108 Sanitize
::sanitizeMessage('[a@./Documentation.html@INVALID9]doc[/a]')
113 * Tests XSS escaping after valid link.
117 public function testLinkDocXss()
120 '[a@./Documentation.html" onmouseover="alert(foo)"]doc</a>',
121 Sanitize
::sanitizeMessage('[a@./Documentation.html" onmouseover="alert(foo)"]doc[/a]')
126 * Tests proper handling of multi link code.
130 public function testLinkAndXssInHref()
133 '<a href="./url.php?url=https%3A%2F%2Fdocs.phpmyadmin.net%2F">doc</a>[a@javascript:alert(\'XSS\');@target]link</a>',
134 Sanitize
::sanitizeMessage('[a@https://docs.phpmyadmin.net/]doc[/a][a@javascript:alert(\'XSS\');@target]link[/a]')
139 * Test escaping of HTML tags
143 public function testHtmlTags()
146 '<div onclick="">',
147 Sanitize
::sanitizeMessage('<div onclick="">')
152 * Tests basic BB code.
156 public function testBBCode()
159 '<strong>strong</strong>',
160 Sanitize
::sanitizeMessage('[strong]strong[/strong]')
165 * Tests output escaping.
169 public function testEscape()
172 '<strong>strong</strong>',
173 Sanitize
::sanitizeMessage('[strong]strong[/strong]', true)
178 * Test for Sanitize::sanitizeFilename
182 public function testSanitizeFilename()
186 Sanitize
::sanitizeFilename('File_name 123')
191 * Test for Sanitize::getJsValue
193 * @param string $key Key
194 * @param string $value Value
195 * @param string $expected Expected output
197 * @dataProvider variables
201 public function testGetJsValue($key, $value, $expected): void
203 $this->assertEquals($expected, Sanitize
::getJsValue($key, $value));
204 $this->assertEquals('foo = 100', Sanitize
::getJsValue('foo', '100', false));
211 "foo = [\"1\",\"2\",\"3\",];\n",
212 Sanitize
::getJsValue('foo', $array)
215 "foo = \"bar\\\"baz\";\n",
216 Sanitize
::getJsValue('foo', 'bar"baz')
221 * Test for Sanitize::jsFormat
225 public function testJsFormat()
227 $this->assertEquals("`foo`", Sanitize
::jsFormat('foo'));
231 * Provider for testFormat
235 public function variables()
266 "foo = \"quote\\\"\";\n",
271 "foo = \"apostroph\\'\";\n",
277 * Sanitize::escapeJsString tests
279 * @param string $target expected output
280 * @param string $source string to be escaped
284 * @dataProvider escapeDataProvider
286 public function testEscapeJsString($target, $source): void
288 $this->assertEquals($target, Sanitize
::escapeJsString($source));
292 * Data provider for testEscape
294 * @return array data for testEscape test case
296 public function escapeDataProvider()
304 '\r\n\\\'<scrIpt></\' + \'script>',
305 "\r\n'<scrIpt></sCRIPT>",
312 '</\' + \'script></head><body>[HTML]',
313 '</SCRIPT></head><body>[HTML]',
320 "\\\\\'\'\'\'\'\'\'\'\'\'\'\'\\\\",
327 * Test for removeRequestVars
331 public function testRemoveRequestVars()
333 $_REQUEST['foo'] = 'bar';
334 $_REQUEST['allow'] = 'all';
335 $_REQUEST['second'] = 1;
340 Sanitize
::removeRequestVars($allow_list);
341 $this->assertArrayNotHasKey('foo', $_REQUEST);
342 $this->assertArrayNotHasKey('second', $_REQUEST);
343 $this->assertArrayHasKey('allow', $_REQUEST);