aboutsummaryrefslogtreecommitdiffstats
path: root/actionview/test/template/sanitize_helper_test.rb
blob: 2b63d3c7aab9649491c2f9461023ce0e6a2aa4e4 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
require 'abstract_unit'

# The exhaustive tests are in  test/template/html-scanner/sanitizer_test.rb
# This tests the that the helpers hook up correctly to the sanitizer classes.
class SanitizeHelperTest < ActionView::TestCase
  tests ActionView::Helpers::SanitizeHelper

  def test_strip_links_pending
    skip "Pending. These tests don't pass. See explanation in sanitizers_test.rb"

    assert_equal "<a<a", strip_links("<a<a")
    assert_equal "all <b>day</b> long", strip_links("<<a>a href='hello'>all <b>day</b> long<</A>/a>")
  end

  def test_strip_links
    assert_equal "Dont touch me", strip_links("Dont touch me")

    assert_equal "on my mind\nall day long", strip_links("<a href='almost'>on my mind</a>\n<A href='almost'>all day long</A>")
    assert_equal "0wn3d", strip_links("<a href='http://www.rubyonrails.com/'><a href='http://www.rubyonrails.com/' onlclick='steal()'>0wn3d</a></a>")
    assert_equal "Magic", strip_links("<a href='http://www.rubyonrails.com/'>Mag<a href='http://www.ruby-lang.org/'>ic")
    assert_equal "FrrFox", strip_links("<href onlclick='steal()'>FrrFox</a></href>")
    assert_equal "My mind\nall <b>day</b> long", strip_links("<a href='almost'>My mind</a>\n<A href='almost'>all <b>day</b> long</A>")
  end

  def test_sanitize_form
    assert_equal '', sanitize("<form action=\"/foo/bar\" method=\"post\"><input></form>")
  end

  def test_should_sanitize_illegal_style_properties
    raw      = %(display:block; position:absolute; left:0; top:0; width:100%; height:100%; z-index:1; background-color:black; background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg); background-x:center; background-y:center; background-repeat:repeat;)
    expected = %(display: block; width: 100%; height: 100%; background-color: black; background-x: center; background-y: center;)
    assert_equal expected, sanitize_css(raw)
  end

  def test_strip_tags_pending
    skip "Pending. These tests don't pass. See explanation in sanitizers_test.rb"

    assert_equal("<<<bad html", strip_tags("<<<bad html"))
    assert_equal("<<", strip_tags("<<<bad html>"))

    assert_equal("Weirdos", strip_tags("Wei<<a>a onclick='alert(document.cookie);'</a>/>rdos"))

    assert_equal(
    %{This is a test.\n\n\nIt no longer contains any HTML.\n}, strip_tags(
    %{<title>This is <b>a <a href="" target="_blank">test</a></b>.</title>\n\n<!-- it has a comment -->\n\n<p>It no <b>longer <strong>contains <em>any <strike>HTML</strike></em>.</strong></b></p>\n}))

    # fails on the blank string
    [nil, '', '   '].each do |blank|
      stripped = strip_tags(blank)
      assert_equal blank, stripped
    end
    
    # Actual: "something "
    assert_equal "something &lt;img onerror=alert(1337)", ERB::Util.html_escape(strip_tags("something <img onerror=alert(1337)"))
  end

  def test_strip_tags

    assert_equal("Dont touch me", strip_tags("Dont touch me"))
    assert_equal("This is a test.", strip_tags("<p>This <u>is<u> a <a href='test.html'><strong>test</strong></a>.</p>"))

    assert_equal("This is a test.", strip_tags("This is a test."))

    assert_equal "This has a  here.", strip_tags("This has a <!-- comment --> here.")

    assert_equal "", strip_tags("<script>")
  end

  def test_sanitize_is_marked_safe
    assert sanitize("<html><script></script></html>").html_safe?
  end
end