use html purifier for sanitation

13 files changed, 629 insertions, 0 deletions

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BackgroundTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BackgroundTest.php
new file mode 100644
index 000000000..2458637f3
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BackgroundTest.php
@@ -0,0 +1,40 @@
+<?php

+

+class HTMLPurifier_AttrTransform_BackgroundTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_Background();

+    }

+

+    function testEmptyInput() {

+        $this->assertResult( array() );

+    }

+

+    function testBasicTransform() {

+        $this->assertResult(

+            array('background' => 'logo.png'),

+            array('style' => 'background-image:url(logo.png);')

+        );

+    }

+

+    function testPrependNewCSS() {

+        $this->assertResult(

+            array('background' => 'logo.png', 'style' => 'font-weight:bold'),

+            array('style' => 'background-image:url(logo.png);font-weight:bold')

+        );

+    }

+

+    function testLenientTreatmentOfInvalidInput() {

+        // notice that we rely on the CSS validator later to fix this invalid

+        // stuff

+        $this->assertResult(

+            array('background' => 'logo.png);foo:('),

+            array('style' => 'background-image:url(logo.png);foo:();')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BdoDirTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BdoDirTest.php
new file mode 100644
index 000000000..02c9ea32f
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BdoDirTest.php
@@ -0,0 +1,30 @@
+<?php

+

+class HTMLPurifier_AttrTransform_BdoDirTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_BdoDir();

+    }

+

+    function testAddDefaultDir() {

+        $this->assertResult( array(), array('dir' => 'ltr') );

+    }

+

+    function testPreserveExistingDir() {

+        $this->assertResult( array('dir' => 'rtl') );

+    }

+

+    function testAlternateDefault() {

+        $this->config->set('Attr.DefaultTextDir', 'rtl');

+        $this->assertResult(

+            array(),

+            array('dir' => 'rtl')

+        );

+

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BgColorTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BgColorTest.php
new file mode 100644
index 000000000..a2fe11b40
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BgColorTest.php
@@ -0,0 +1,44 @@
+<?php

+

+// we currently rely on the CSS validator to fix any problems.

+// This means that this transform, strictly speaking, supports

+// a superset of the functionality.

+

+class HTMLPurifier_AttrTransform_BgColorTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_BgColor();

+    }

+

+    function testEmptyInput() {

+        $this->assertResult( array() );

+    }

+

+    function testBasicTransform() {

+        $this->assertResult(

+            array('bgcolor' => '#000000'),

+            array('style' => 'background-color:#000000;')

+        );

+    }

+

+    function testPrependNewCSS() {

+        $this->assertResult(

+            array('bgcolor' => '#000000', 'style' => 'font-weight:bold'),

+            array('style' => 'background-color:#000000;font-weight:bold')

+        );

+    }

+

+    function testLenientTreatmentOfInvalidInput() {

+        // this may change when we natively support the datatype and

+        // validate its contents before forwarding it on

+        $this->assertResult(

+            array('bgcolor' => '#F00'),

+            array('style' => 'background-color:#F00;')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BoolToCSSTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BoolToCSSTest.php
new file mode 100644
index 000000000..296657be4
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BoolToCSSTest.php
@@ -0,0 +1,38 @@
+<?php

+

+class HTMLPurifier_AttrTransform_BoolToCSSTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_BoolToCSS('foo', 'bar:3in;');

+    }

+

+    function testEmptyInput() {

+        $this->assertResult( array() );

+    }

+

+    function testBasicTransform() {

+        $this->assertResult(

+            array('foo' => 'foo'),

+            array('style' => 'bar:3in;')

+        );

+    }

+

+    function testIgnoreValueOfBooleanAttribute() {

+        $this->assertResult(

+            array('foo' => 'no'),

+            array('style' => 'bar:3in;')

+        );

+    }

+

+    function testPrependCSS() {

+        $this->assertResult(

+            array('foo' => 'foo', 'style' => 'background-color:#F00;'),

+            array('style' => 'bar:3in;background-color:#F00;')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BorderTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BorderTest.php
new file mode 100644
index 000000000..f9ead1f28
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/BorderTest.php
@@ -0,0 +1,38 @@
+<?php

+

+class HTMLPurifier_AttrTransform_BorderTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_Border();

+    }

+

+    function testEmptyInput() {

+        $this->assertResult( array() );

+    }

+

+    function testBasicTransform() {

+        $this->assertResult(

+            array('border' => '1'),

+            array('style' => 'border:1px solid;')

+        );

+    }

+

+    function testLenientTreatmentOfInvalidInput() {

+        $this->assertResult(

+            array('border' => '10%'),

+            array('style' => 'border:10%px solid;')

+        );

+    }

+

+    function testPrependNewCSS() {

+        $this->assertResult(

+            array('border' => '23', 'style' => 'font-weight:bold;'),

+            array('style' => 'border:23px solid;font-weight:bold;')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/EnumToCSSTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/EnumToCSSTest.php
new file mode 100644
index 000000000..62ee957b9
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/EnumToCSSTest.php
@@ -0,0 +1,73 @@
+<?php

+

+class HTMLPurifier_AttrTransform_EnumToCSSTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_EnumToCSS('align', array(

+            'left'  => 'text-align:left;',

+            'right' => 'text-align:right;'

+        ));

+    }

+

+    function testEmptyInput() {

+        $this->assertResult( array() );

+    }

+

+    function testPreserveArraysWithoutInterestingAttributes() {

+        $this->assertResult( array('style' => 'font-weight:bold;') );

+    }

+

+    function testConvertAlignLeft() {

+        $this->assertResult(

+            array('align' => 'left'),

+            array('style' => 'text-align:left;')

+        );

+    }

+

+    function testConvertAlignRight() {

+        $this->assertResult(

+            array('align' => 'right'),

+            array('style' => 'text-align:right;')

+        );

+    }

+

+    function testRemoveInvalidAlign() {

+        $this->assertResult(

+            array('align' => 'invalid'),

+            array()

+        );

+    }

+

+    function testPrependNewCSS() {

+        $this->assertResult(

+            array('align' => 'left', 'style' => 'font-weight:bold;'),

+            array('style' => 'text-align:left;font-weight:bold;')

+        );

+

+    }

+

+    function testCaseInsensitive() {

+        $this->obj = new HTMLPurifier_AttrTransform_EnumToCSS('align', array(

+            'right' => 'text-align:right;'

+        ));

+        $this->assertResult(

+            array('align' => 'RIGHT'),

+            array('style' => 'text-align:right;')

+        );

+    }

+

+    function testCaseSensitive() {

+        $this->obj = new HTMLPurifier_AttrTransform_EnumToCSS('align', array(

+            'right' => 'text-align:right;'

+        ), true);

+        $this->assertResult(

+            array('align' => 'RIGHT'),

+            array()

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/ImgRequiredTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/ImgRequiredTest.php
new file mode 100644
index 000000000..da7934b0c
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/ImgRequiredTest.php
@@ -0,0 +1,55 @@
+<?php

+

+class HTMLPurifier_AttrTransform_ImgRequiredTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_ImgRequired();

+    }

+

+    function testAddMissingAttr() {

+        $this->config->set('Core.RemoveInvalidImg', false);

+        $this->assertResult(

+            array(),

+            array('src' => '', 'alt' => 'Invalid image')

+        );

+    }

+

+    function testAlternateDefaults() {

+        $this->config->set('Attr.DefaultInvalidImage', 'blank.png');

+        $this->config->set('Attr.DefaultInvalidImageAlt', 'Pawned!');

+        $this->config->set('Attr.DefaultImageAlt', 'not pawned');

+        $this->config->set('Core.RemoveInvalidImg', false);

+        $this->assertResult(

+            array(),

+            array('src' => 'blank.png', 'alt' => 'Pawned!')

+        );

+    }

+

+    function testGenerateAlt() {

+        $this->assertResult(

+            array('src' => '/path/to/foobar.png'),

+            array('src' => '/path/to/foobar.png', 'alt' => 'foobar.png')

+        );

+    }

+

+    function testAddDefaultSrc() {

+        $this->config->set('Core.RemoveInvalidImg', false);

+        $this->assertResult(

+            array('alt' => 'intrigue'),

+            array('alt' => 'intrigue', 'src' => '')

+        );

+    }

+

+    function testAddDefaultAlt() {

+        $this->config->set('Attr.DefaultImageAlt', 'default');

+        $this->assertResult(

+            array('src' => ''),

+            array('src' => '', 'alt' => 'default')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/ImgSpaceTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/ImgSpaceTest.php
new file mode 100644
index 000000000..33426b2b3
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/ImgSpaceTest.php
@@ -0,0 +1,55 @@
+<?php

+

+class HTMLPurifier_AttrTransform_ImgSpaceTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_ImgSpace('vspace');

+    }

+

+    function testEmptyInput() {

+        $this->assertResult( array() );

+    }

+

+    function testVerticalBasicUsage() {

+        $this->assertResult(

+            array('vspace' => '1'),

+            array('style' => 'margin-top:1px;margin-bottom:1px;')

+        );

+    }

+

+    function testLenientHandlingOfInvalidInput() {

+        $this->assertResult(

+            array('vspace' => '10%'),

+            array('style' => 'margin-top:10%px;margin-bottom:10%px;')

+        );

+    }

+

+    function testPrependNewCSS() {

+        $this->assertResult(

+            array('vspace' => '23', 'style' => 'font-weight:bold;'),

+            array('style' => 'margin-top:23px;margin-bottom:23px;font-weight:bold;')

+        );

+    }

+

+    function testHorizontalBasicUsage() {

+        $this->obj = new HTMLPurifier_AttrTransform_ImgSpace('hspace');

+        $this->assertResult(

+            array('hspace' => '1'),

+            array('style' => 'margin-left:1px;margin-right:1px;')

+        );

+    }

+

+    function testInvalidConstructionParameter() {

+        $this->expectError('ispace is not valid space attribute');

+        $this->obj = new HTMLPurifier_AttrTransform_ImgSpace('ispace');

+        $this->assertResult(

+            array('ispace' => '1'),

+            array()

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/InputTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/InputTest.php
new file mode 100644
index 000000000..c2cb3845b
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/InputTest.php
@@ -0,0 +1,94 @@
+<?php

+

+class HTMLPurifier_AttrTransform_InputTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_Input();

+    }

+

+    function testEmptyInput() {

+        $this->assertResult(array());

+    }

+

+    function testInvalidCheckedWithEmpty() {

+        $this->assertResult(array('checked' => 'checked'), array());

+    }

+

+    function testInvalidCheckedWithPassword() {

+        $this->assertResult(array(

+            'checked' => 'checked',

+            'type' => 'password'

+        ), array(

+            'type' => 'password'

+        ));

+    }

+

+    function testValidCheckedWithUcCheckbox() {

+        $this->assertResult(array(

+            'checked' => 'checked',

+            'type' => 'CHECKBOX',

+            'value' => 'bar',

+        ));

+    }

+

+    function testInvalidMaxlength() {

+        $this->assertResult(array(

+            'maxlength' => '10',

+            'type' => 'checkbox',

+            'value' => 'foo',

+        ), array(

+            'type' => 'checkbox',

+            'value' => 'foo',

+        ));

+    }

+

+    function testValidMaxLength() {

+        $this->assertResult(array(

+            'maxlength' => '10',

+        ));

+    }

+

+    // these two are really bad test-cases

+

+    function testSizeWithCheckbox() {

+        $this->assertResult(array(

+            'type' => 'checkbox',

+            'value' => 'foo',

+            'size' => '100px',

+        ), array(

+            'type' => 'checkbox',

+            'value' => 'foo',

+            'size' => '100',

+        ));

+    }

+

+    function testSizeWithText() {

+        $this->assertResult(array(

+            'type' => 'password',

+            'size' => '100px', // spurious value, to indicate no validation takes place

+        ), array(

+            'type' => 'password',

+            'size' => '100px',

+        ));

+    }

+

+    function testInvalidSrc() {

+        $this->assertResult(array(

+            'src' => 'img.png',

+        ), array());

+    }

+

+    function testMissingValue() {

+        $this->assertResult(array(

+            'type' => 'checkbox',

+        ), array(

+            'type' => 'checkbox',

+            'value' => '',

+        ));

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/LangTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/LangTest.php
new file mode 100644
index 000000000..45d007844
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/LangTest.php
@@ -0,0 +1,46 @@
+<?php

+

+class HTMLPurifier_AttrTransform_LangTest

+    extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_Lang();

+    }

+

+    function testEmptyInput() {

+        $this->assertResult(array());

+    }

+

+    function testCopyLangToXMLLang() {

+        $this->assertResult(

+            array('lang' => 'en'),

+            array('lang' => 'en', 'xml:lang' => 'en')

+        );

+    }

+

+    function testPreserveAttributes() {

+        $this->assertResult(

+            array('src' => 'vert.png', 'lang' => 'fr'),

+            array('src' => 'vert.png', 'lang' => 'fr', 'xml:lang' => 'fr')

+        );

+    }

+

+    function testCopyXMLLangToLang() {

+        $this->assertResult(

+            array('xml:lang' => 'en'),

+            array('xml:lang' => 'en', 'lang' => 'en')

+        );

+    }

+

+    function testXMLLangOverridesLang() {

+        $this->assertResult(

+            array('lang' => 'fr', 'xml:lang' => 'de'),

+            array('lang' => 'de', 'xml:lang' => 'de')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/LengthTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/LengthTest.php
new file mode 100644
index 000000000..a80aa7dcc
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/LengthTest.php
@@ -0,0 +1,45 @@
+<?php

+

+class HTMLPurifier_AttrTransform_LengthTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_Length('width');

+    }

+

+    function testEmptyInput() {

+        $this->assertResult( array() );

+    }

+

+    function testTransformPixel() {

+        $this->assertResult(

+            array('width' => '10'),

+            array('style' => 'width:10px;')

+        );

+    }

+

+    function testTransformPercentage() {

+        $this->assertResult(

+            array('width' => '10%'),

+            array('style' => 'width:10%;')

+        );

+    }

+

+    function testPrependNewCSS() {

+        $this->assertResult(

+            array('width' => '10%', 'style' => 'font-weight:bold'),

+            array('style' => 'width:10%;font-weight:bold')

+        );

+    }

+

+    function testLenientTreatmentOfInvalidInput() {

+        $this->assertResult(

+            array('width' => 'asdf'),

+            array('style' => 'width:asdf;')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/NameSyncTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/NameSyncTest.php
new file mode 100644
index 000000000..998f951bd
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/NameSyncTest.php
@@ -0,0 +1,40 @@
+<?php

+

+class HTMLPurifier_AttrTransform_NameSyncTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_NameSync();

+        $this->accumulator = new HTMLPurifier_IDAccumulator();

+        $this->context->register('IDAccumulator', $this->accumulator);

+        $this->config->set('Attr.EnableID', true);

+    }

+

+    function testEmpty() {

+        $this->assertResult( array() );

+    }

+

+    function testAllowSame() {

+        $this->assertResult(

+            array('name' => 'free', 'id' => 'free')

+        );

+    }

+

+    function testAllowDifferent() {

+        $this->assertResult(

+            array('name' => 'tryit', 'id' => 'thisgood')

+        );

+    }

+

+    function testCheckName() {

+        $this->accumulator->add('notok');

+        $this->assertResult(

+            array('name' => 'notok', 'id' => 'ok'),

+            array('id' => 'ok')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4

diff --git a/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/NameTest.php b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/NameTest.php
new file mode 100644
index 000000000..e410d6d87
--- /dev/null
+++ b/3rdparty/htmlpurifier/tests/HTMLPurifier/AttrTransform/NameTest.php
@@ -0,0 +1,31 @@
+<?php

+

+class HTMLPurifier_AttrTransform_NameTest extends HTMLPurifier_AttrTransformHarness

+{

+

+    function setUp() {

+        parent::setUp();

+        $this->obj = new HTMLPurifier_AttrTransform_Name();

+    }

+

+    function testEmpty() {

+        $this->assertResult( array() );

+    }

+

+    function testTransformNameToID() {

+        $this->assertResult(

+            array('name' => 'free'),

+            array('id' => 'free')

+        );

+    }

+

+    function testExistingIDOverridesName() {

+        $this->assertResult(

+            array('name' => 'tryit', 'id' => 'tobad'),

+            array('id' => 'tobad')

+        );

+    }

+

+}

+

+// vim: et sw=4 sts=4