51 lines
2.5 KiB
Perl
Executable File
51 lines
2.5 KiB
Perl
Executable File
#!/usr/bin/perl
|
|
use warnings;
|
|
use strict;
|
|
use Test::More tests => 16;
|
|
use Encode;
|
|
|
|
BEGIN { use_ok("IkiWiki"); }
|
|
|
|
# Initialize htmlscrubber plugin
|
|
%config=IkiWiki::defaultconfig();
|
|
$config{srcdir}=$config{destdir}="/dev/null";
|
|
IkiWiki::loadplugins();
|
|
IkiWiki::checkconfig();
|
|
|
|
is(IkiWiki::htmlize("foo", "mdwn", "foo\n\nbar\n"), "<p>foo</p>\n\n<p>bar</p>\n",
|
|
"basic");
|
|
is(IkiWiki::htmlize("foo", "mdwn", readfile("t/test1.mdwn")),
|
|
Encode::decode_utf8(qq{<p><img src="../images/o.jpg" alt="o" title="ó" />\nóóóóó</p>\n}),
|
|
"utf8; bug #373203");
|
|
ok(IkiWiki::htmlize("foo", "mdwn", readfile("t/test2.mdwn")),
|
|
"this file crashes markdown if it's fed in as decoded utf-8");
|
|
|
|
# embedded javascript sanitisation tests
|
|
sub gotcha {
|
|
my $html=IkiWiki::htmlize("foo", "mdwn", shift);
|
|
return $html =~ /GOTCHA/;
|
|
}
|
|
ok(!gotcha(q{<a href="javascript:alert('GOTCHA')">click me</a>}),
|
|
"javascript url");
|
|
ok(!gotcha(q{<a href="javascript:alert('GOTCHA')">click me</a>}),
|
|
"partially encoded javascript url");
|
|
ok(!gotcha(q{<a href="jscript:alert('GOTCHA')">click me</a>}),
|
|
"jscript url");
|
|
ok(!gotcha(q{<a href="vbscript:alert('GOTCHA')">click me</a>}),
|
|
"vbscrpt url");
|
|
ok(!gotcha(q{<a href="java script:alert('GOTCHA')">click me</a>}),
|
|
"java-tab-script url");
|
|
ok(!gotcha(q{<span style="any: expressio(GOTCHA)n(window.location='http://example.org/')">foo</span>}),
|
|
"entity-encoded CSS script test");
|
|
ok(!gotcha(q{<span style="any: expression(GOTCHA)(window.location='http://example.org/')">foo</span>}),
|
|
"another entity-encoded CSS script test");
|
|
ok(!gotcha(q{<script>GOTCHA</script>}),
|
|
"script tag");
|
|
ok(!gotcha(q{<span style="background: url(javascript:window.location=GOTCHA)">a</span>}),
|
|
"CSS script test");
|
|
ok(gotcha(q{<p>javascript:alert('GOTCHA')</p>}),
|
|
"not javascript AFAIK (but perhaps some web browser would like to
|
|
be perverse and assume it is?)");
|
|
ok(gotcha(q{<img src="javascript.png?GOTCHA">}), "not javascript");
|
|
ok(gotcha(q{<a href="javascript.png?GOTCHA">foo</a>}), "not javascript");
|