Page MenuHomeWickedGov Phorge
Files F4134713

ve.sanitize.test.js
No OneTemporary
Actions

Size
3 KB
Referenced Files
None
Subscribers
None

ve.sanitize.test.js
View Options

/*!
* VisualEditor HTML sanitization utilities tests.
*
* @copyright See AUTHORS.txt
*/
QUnit.module( 've.sanitize' );
QUnit.test( 've.sanitizeHtml', ( assert ) => {
const cases = [
{
msg: 'Unsafe link href removed',
html: '<a href="javascript:alert(1);">Foo</a>',
expected: '<a>Foo</a>'
},
{
msg: 'Unsafe onclick removed',
html: '<span onclick="alert(1);">Foo</span>',
expected: '<span>Foo</span>'
},
{
msg: 'script and style elements removed',
html: '<script></script><style></style>',
expected: ''
},
{
msg: 'style attribute allowed',
html: '<span style="font-weight: 700;">Foo</span>',
expected: '<span style="font-weight: 700;">Foo</span>'
},
{
msg: 'RDFa attributes allowed',
html: '<span about="#1" rel="#2" resource="#3" property="#4" content="#5" dataType="#6" typeof="#7">Foo</span>',
expected: '<span about="#1" rel="#2" resource="#3" property="#4" content="#5" dataType="#6" typeof="#7">Foo</span>'
},
{
msg: 'figure-inline element allowed',
html: '<figure-inline></figure-inline>',
expected: '<figure-inline></figure-inline>'
},
{
msg: 'HTML tag in attribute allowed',
html: '<span content="&lt;b&gt;Foo&lt;/b&gt;">Foo</span>',
expected: '<span content="&lt;b&gt;Foo&lt;/b&gt;">Foo</span>'
},
{
msg: 'Self-closing HTML tag in attribute allowed',
html: '<span content="&lt;img/&gt;">Foo</span>',
expected: '<span content="&lt;img/&gt;">Foo</span>'
}
];
cases.forEach( ( caseItem ) => {
const actual = document.createElement( 'div' );
const nodes = ve.sanitizeHtml( caseItem.html );
Array.prototype.forEach.call( nodes, ( node ) => {
actual.appendChild( node );
} );
const expected = document.createElement( 'div' );
expected.innerHTML = caseItem.expected;
assert.equalDomElement( actual, expected, caseItem.msg );
} );
} );
QUnit.test( 've.sanitizeHtmlToDocument', ( assert ) => {
const nodes = ve.sanitizeHtml( '<a href="allowed">Foo</a>' );
const body = document.createElement( 'body' );
Array.prototype.forEach.call( nodes, ( node ) => {
body.appendChild( node );
} );
const sanitizedDocument = ve.sanitizeHtmlToDocument( '<a href="allowed">Foo</a>' );
assert.equalDomElement( sanitizedDocument.body, body, 'Body node is the same as if we used ve.sanitizeHtml' );
} );
QUnit.test( 've.setAttributeSafe', ( assert ) => {
const cases = [
{
msg: 'Unsafe link href sets fallback instead',
element: '<a rel="bar">Foo</a>',
attr: 'href',
// eslint-disable-next-line no-script-url
val: 'javascript:alert(1)',
fallbackVal: '#',
expected: '<a href="#" rel="bar">Foo</a>'
},
{
msg: 'Unsafe link href without fallback is no-op',
element: '<a rel="bar">Foo</a>',
attr: 'href',
// eslint-disable-next-line no-script-url
val: 'javascript:alert(1)',
expected: '<a rel="bar">Foo</a>'
},
{
msg: 'Safe link is set',
element: '<a rel="bar">Foo</a>',
attr: 'href',
val: '#javascript',
expected: '<a href="#javascript" rel="bar">Foo</a>'
},
{
msg: 'onclick is not set',
element: '<div>Foo</div>',
attr: 'onclick',
val: 'alert()',
expected: '<div>Foo</div>'
},
{
msg: 'RDFa attribute is set',
element: '<div>Foo</div>',
attr: 'about',
val: '#1',
expected: '<div about="#1">Foo</div>'
}
];
cases.forEach( ( caseItem ) => {
const actual = document.createElement( 'div' );
actual.innerHTML = caseItem.element;
ve.setAttributeSafe(
actual.childNodes[ 0 ],
caseItem.attr,
caseItem.val,
caseItem.fallbackVal
);
const expected = document.createElement( 'div' );
expected.innerHTML = caseItem.expected;
assert.equalDomElement( actual, expected, caseItem.msg );
} );
} );

File Metadata

Mime Type
text/html
Expires
Wed, Aug 19, 12:47 (3 w, 2 d ago)
Storage Engine
local-disk
Storage Format
Raw Data
Storage Handle
fe/02/cb8adcf5a3f5e1ae2821bae444cc
Default Alt Text
ve.sanitize.test.js (3 KB)

Event Timeline