HomePhorge
Diffusion Phorge (master) Code

phorge/src/infrastructure/markup/__tests__/PhutilMarkupTestCase.php
f9b3e3360b0cmaster

Last Change
Raw File

PhutilMarkupTestCase.php
View Options

<?php
final class PhutilMarkupTestCase extends PhutilTestCase {
public function testTagDefaults() {
$this->assertEqual(
(string)phutil_tag('br'),
(string)phutil_tag('br', array()));
$this->assertEqual(
(string)phutil_tag('br', array()),
(string)phutil_tag('br', array(), null));
}
public function testTagEmpty() {
$this->assertEqual(
'<br />',
(string)phutil_tag('br', array(), null));
$this->assertEqual(
'<div></div>',
(string)phutil_tag('div', array(), null));
$this->assertEqual(
'<div></div>',
(string)phutil_tag('div', array(), ''));
}
public function testTagBasics() {
$this->assertEqual(
'<br />',
(string)phutil_tag('br'));
$this->assertEqual(
'<div>y</div>',
(string)phutil_tag('div', array(), 'y'));
}
public function testTagAttributes() {
$this->assertEqual(
'<div u="v">y</div>',
(string)phutil_tag('div', array('u' => 'v'), 'y'));
$this->assertEqual(
'<br u="v" />',
(string)phutil_tag('br', array('u' => 'v')));
}
public function testTagEscapes() {
$this->assertEqual(
'<br u="&lt;" />',
(string)phutil_tag('br', array('u' => '<')));
$this->assertEqual(
'<div><br /></div>',
(string)phutil_tag('div', array(), phutil_tag('br')));
}
public function testTagNullAttribute() {
$this->assertEqual(
'<br />',
(string)phutil_tag('br', array('y' => null)));
}
public function testTagJavascriptProtocolRejection() {
$hrefs = array(
'javascript:alert(1)' => true,
'JAVASCRIPT:alert(2)' => true,
// NOTE: When interpreted as a URI, this is dropped because of leading
// whitespace.
' javascript:alert(3)' => array(true, false),
'/' => false,
'/path/to/stuff/' => false,
'' => false,
'http://example.com/' => false,
'#' => false,
'javascript://anything' => true,
// Chrome 33 and IE11, at a minimum, treat this as Javascript.
"javascript\n:alert(4)" => true,
// Opera currently accepts a variety of unicode spaces. This test case
// has a smattering of them.
"\xE2\x80\x89javascript:" => true,
"javascript\xE2\x80\x89:" => true,
"\xE2\x80\x84javascript:" => true,
"javascript\xE2\x80\x84:" => true,
// Because we're aggressive, all of unicode should trigger detection
// by default.
"\xE2\x98\x83javascript:" => true,
"javascript\xE2\x98\x83:" => true,
"\xE2\x98\x83javascript\xE2\x98\x83:" => true,
// We're aggressive about this, so we'll intentionally raise false
// positives in these cases.
'javascript~:alert(5)' => true,
'!!!javascript!!!!:alert(6)' => true,
// However, we should raise true negatives in these slightly more
// reasonable cases.
'javascript/:docs.html' => false,
'javascripts:x.png' => false,
'COOLjavascript:page' => false,
'/javascript:alert(1)' => false,
);
foreach (array(true, false) as $use_uri) {
foreach ($hrefs as $href => $expect) {
if (is_array($expect)) {
$expect = ($use_uri ? $expect[1] : $expect[0]);
}
if ($use_uri) {
$href_value = new PhutilURI($href);
} else {
$href_value = $href;
}
$caught = null;
try {
phutil_tag('a', array('href' => $href_value), 'click for candy');
} catch (Exception $ex) {
$caught = $ex;
}
$desc = pht(
'Unexpected result for "%s". <uri = %s, expect exception = %s>',
$href,
$use_uri ? pht('Yes') : pht('No'),
$expect ? pht('Yes') : pht('No'));
$this->assertEqual(
$expect,
$caught instanceof Exception,
$desc);
}
}
}
public function testURIEscape() {
$this->assertEqual(
'%2B/%20%3F%23%26%3A%21xyz%25',
phutil_escape_uri('+/ ?#&:!xyz%'));
}
public function testURIPathComponentEscape() {
$this->assertEqual(
'a%252Fb',
phutil_escape_uri_path_component('a/b'));
$str = '';
for ($ii = 0; $ii <= 255; $ii++) {
$str .= chr($ii);
}
$this->assertEqual(
$str,
phutil_unescape_uri_path_component(
rawurldecode( // Simulates webserver.
phutil_escape_uri_path_component($str))));
}
public function testHsprintf() {
$this->assertEqual(
'<div>&lt;3</div>',
(string)hsprintf('<div>%s</div>', '<3'));
}
public function testAppendHTML() {
$html = phutil_tag('hr');
$html->appendHTML(phutil_tag('br'), '<evil>');
$this->assertEqual('<hr /><br />&lt;evil&gt;', $html->getHTMLContent());
}
public function testArrayEscaping() {
$this->assertEqual(
'<div>&lt;div&gt;</div>',
phutil_escape_html(
array(
hsprintf('<div>'),
array(
array(
'<',
array(
'd',
array(
array(
hsprintf('i'),
),
'v',
),
),
array(
array(
'>',
),
),
),
),
hsprintf('</div>'),
)));
$this->assertEqual(
'<div><br /><hr /><wbr /></div>',
phutil_tag(
'div',
array(),
array(
array(
array(
phutil_tag('br'),
array(
phutil_tag('hr'),
),
phutil_tag('wbr'),
),
),
))->getHTMLContent());
}
}

Owner Packages

  • No Owners