mirror/php-htmlpurifier
1
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2025-07-31 03:10:09 +02:00
Code Issues Releases Wiki Activity

Protect against font family innerHTML/cssText attacks.

Browse Source 
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
This commit is contained in:
Edward Z. Yang
2011-03-27 20:35:38 +01:00
parent 0dd9e4faf4
commit afb007d22f
10 changed files with 188 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
tests/HTMLPurifier/AttrDef/CSS/FontFamilyTest.php
View File

@@ -8,30 +8,32 @@ class HTMLPurifier_AttrDef_CSS_FontFamilyTest extends HTMLPurifier_AttrDefHarnes
$this->def = new HTMLPurifier_AttrDef_CSS_FontFamily();
$this->assertDef('Gill, Helvetica, sans-serif');
$this->assertDef('"Times New Roman", serif');
$this->assertDef('\'Times New Roman\'', '"Times New Roman"');
$this->assertDef("'Times New Roman', serif");
$this->assertDef("\"Times New Roman\"", "'Times New Roman'");
$this->assertDef('01234');
$this->assertDef(',', false);
$this->assertDef('Times New Roman, serif', '"Times New Roman", serif');
$this->assertDef($d = '"John\'s Font"');
$this->assertDef("John's Font", $d);
$this->assertDef($d = "\"\xE5\xAE\x8B\xE4\xBD\x93\"");
$this->assertDef('Times New Roman, serif', "'Times New Roman', serif");
$this->assertDef($d = "'\xE5\xAE\x8B\xE4\xBD\x93'");
$this->assertDef("\xE5\xAE\x8B\xE4\xBD\x93", $d);
$this->assertDef("'\\','f'", "\"\\5C \", f");
$this->assertDef("'\\01'", "\"\"");
$this->assertDef("'\\20'", "\" \"");
$this->assertDef("\\0020", "\" \"");
$this->assertDef("'\\01'", "''");
$this->assertDef("'\\20'", "' '");
$this->assertDef("\\0020", "' '");
$this->assertDef("'\\000045'", "E");
$this->assertDef("','", false);
$this->assertDef("',' foobar','", "\" foobar\"");
$this->assertDef("'\\27'", "\"'\"");
$this->assertDef('"\\22"', "\"\\22 \"");
$this->assertDef('"\\""', "\"\\22 \"");
$this->assertDef('"\'"', "\"'\"");
$this->assertDef("',' foobar','", "' foobar'");
$this->assertDef("'\\000045a'", "Ea");
$this->assertDef("'\\00045 a'", "Ea");
$this->assertDef("'\\00045 a'", "\"E a\"");
$this->assertDef("'\\00045 a'", "'E a'");
$this->assertDef("'\\\nf'", "f");
// No longer supported, except maybe in NoJS mode (see source
// file for more explanation)
//$this->assertDef($d = '"John\'s Font"');
//$this->assertDef("John's Font", $d);
//$this->assertDef("'\\','f'", "\"\\5C \", f");
//$this->assertDef("'\\27'", "\"'\"");
//$this->assertDef('"\\22"', "\"\\22 \"");
//$this->assertDef('"\\""', "\"\\22 \"");
//$this->assertDef('"\'"', "\"'\"");
}
function testAllowed() {
@@ -40,8 +42,8 @@ class HTMLPurifier_AttrDef_CSS_FontFamilyTest extends HTMLPurifier_AttrDefHarnes
$this->assertDef('serif');
$this->assertDef('sans-serif', false);
$this->assertDef('serif, sans-serif', 'serif');
$this->assertDef('Times New Roman', '"Times New Roman"');
$this->assertDef('"Times New Roman"');
$this->assertDef('Times New Roman', "'Times New Roman'");
$this->assertDef("'Times New Roman'");
$this->assertDef('foo', false);
}

4
tests/HTMLPurifier/AttrDef/CSS/FontTest.php
View File

@@ -11,10 +11,10 @@ class HTMLPurifier_AttrDef_CSS_FontTest extends HTMLPurifier_AttrDefHarness
// hodgepodge of usage cases from W3C spec, but " -> '
$this->assertDef('12px/14px sans-serif');
$this->assertDef('80% sans-serif');
$this->assertDef('x-large/110% "New Century Schoolbook", serif');
$this->assertDef("x-large/110% 'New Century Schoolbook', serif");
$this->assertDef('bold italic large Palatino, serif');
$this->assertDef('normal small-caps 120%/120% fantasy');
$this->assertDef('300 italic 1.3em/1.7em "FB Armada", sans-serif');
$this->assertDef("300 italic 1.3em/1.7em 'FB Armada', sans-serif");
$this->assertDef('600 9px Charcoal');
$this->assertDef('600 9px/ 12px Charcoal', '600 9px/12px Charcoal');

2
tests/HTMLPurifier/AttrDef/CSSTest.php
View File

@@ -62,7 +62,7 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
$this->assertDef('width:-50px;', false);
$this->assertDef('text-decoration:underline;');
$this->assertDef('font-family:sans-serif;');
$this->assertDef('font-family:Gill, "Times New Roman", sans-serif;');
$this->assertDef("font-family:Gill, 'Times New Roman', sans-serif;");
$this->assertDef('font:12px serif;');
$this->assertDef('border:1px solid #000;');
$this->assertDef('border-bottom:2em double #FF00FA;');

13
tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php
View File

@@ -79,10 +79,13 @@ class HTMLPurifier_Filter_ExtractStyleBlocksTest extends HTMLPurifier_Harness
}
function test_cleanCSS_angledBrackets() {
$this->assertCleanCSS(
".class {\nfont-family:'</style>';\n}",
".class {\nfont-family:\"\\3C /style\\3E \";\n}"
);
// [Content] No longer can smuggle in angled brackets using
// font-family; when we add support for 'content', reinstate
// this test.
//$this->assertCleanCSS(
// ".class {\nfont-family:'</style>';\n}",
// ".class {\nfont-family:\"\\3C /style\\3E \";\n}"
//);
}
function test_cleanCSS_angledBrackets2() {
@@ -97,6 +100,7 @@ class HTMLPurifier_Filter_ExtractStyleBlocksTest extends HTMLPurifier_Harness
$this->assertCleanCSS("div {bogus:tree;}", "div {\n}");
}
/* [CONTENT]
function test_cleanCSS_escapeCodes() {
$this->assertCleanCSS(
".class {\nfont-family:\"\\3C /style\\3E \";\n}"
@@ -109,6 +113,7 @@ class HTMLPurifier_Filter_ExtractStyleBlocksTest extends HTMLPurifier_Harness
".class {\nfont-family:\"</style>\";\n}"
);
}
*/
function test_cleanCSS_scope() {
$this->config->set('Filter.ExtractStyleBlocks.Scope', '#foo');

2
tests/HTMLPurifier/HTMLT/shift-jis-preserve-yen.htmlt
View File

@@ -4,5 +4,5 @@ if (!function_exists('iconv')) return true;
Core.Encoding = "Shift_JIS"
Core.EscapeNonASCIICharacters = true
--HTML--
<b style="font-family:&quot;&#165;&quot;;">111</b>
<b style="font-family:'&#165;';">111</b>
--# vim: et sw=4 sts=4

4
tests/HTMLPurifier/HTMLT/shift-jis-remove-yen.htmlt
View File

@@ -3,7 +3,7 @@ if (!function_exists('iconv')) return true;
--INI--
Core.Encoding = Shift_JIS
--HTML--
<b style="font-family:&quot;&#165;&quot;;">111</b>
<b style="font-family:'&#165;';">111</b>
--EXPECT--
<b style="font-family:&quot;&quot;;">111</b>
<b style="font-family:'';">111</b>
--# vim: et sw=4 sts=4