Skip to content

Commit aa3e9bd

Browse files
cswarecsware
committed
Increase test coverage
Signed-off-by: Sven Strickroth <email@cs-ware.de>
1 parent 91c5fdc commit aa3e9bd

File tree

4 files changed

+254
-2
lines changed

4 files changed

+254
-2
lines changed

‎src/main/java/org/owasp/html/CssSchema.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,15 +164,16 @@ public static CssSchema withProperties(
164164
Map<String, Property> propertyMap =
165165
new HashMap<>();
166166
// check that all fnKeys are defined in properties.
167-
for (Map.Entry<String, Property> e : propertyMap.entrySet()) {
167+
for (Map.Entry<? extends String, ? extends Property> e : properties.entrySet()) {
168168
Property property = e.getValue();
169169
for (String fnKey : property.fnKeys.values()) {
170-
if (!propertyMap.containsKey(fnKey)) {
170+
if (!properties.containsKey(fnKey)) {
171171
throw new IllegalArgumentException(
172172
"Property map is not self contained. " + e.getValue()
173173
+ " depends on undefined function key " + fnKey);
174174
}
175175
}
176+
propertyMap.put(e.getKey(), e.getValue());
176177
}
177178
return new CssSchema(Map.copyOf(propertyMap));
178179
}

‎src/test/java/org/owasp/html/CssSchemaTest.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,9 @@ public static final void testDangerousProperties() {
5555
// Prefix corner cases.
5656
"-",
5757
"-moz-",
58+
"-ms-",
59+
"-o-",
60+
"-webkit-",
5861
}) {
5962
assertSame(key, CssSchema.DISALLOWED, CssSchema.DEFAULT.forKey(key));
6063
}

‎src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,10 @@
2929
package org.owasp.html;
3030

3131
import java.util.Arrays;
32+
import java.util.Collections;
3233
import java.util.List;
3334
import java.util.Locale;
35+
import java.util.Map;
3436
import java.util.Set;
3537
import java.util.regex.Pattern;
3638
import java.util.stream.Collectors;
@@ -229,6 +231,96 @@ public static final void testStyleFiltering() {
229231
.allowStandardUrlProtocols()));
230232
}
231233

234+
@Test
235+
public void testSpecificStyleFilterung() {
236+
assertEquals(
237+
Arrays.stream(new String[] {
238+
"<h1>Header</h1>",
239+
"<p>Paragraph 1</p>",
240+
"<p>Click me out</p>",
241+
"<p></p>",
242+
"<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
243+
"</p><p style=\"text-align:center\">Stylish Para 1</p>",
244+
"<p style=\"color:red\">Stylish Para 2</p>",
245+
""}).collect(Collectors.joining("\n")),
246+
apply(new HtmlPolicyBuilder()
247+
.allowCommonInlineFormattingElements()
248+
.allowCommonBlockElements()
249+
.allowStyling(CssSchema.withProperties(
250+
List.of("color", "text-align", "font-size")))
251+
.allowStandardUrlProtocols()));
252+
}
253+
254+
@Test
255+
public void testUnionStyleFilterung() {
256+
assertEquals(
257+
Arrays.stream(new String[] {
258+
"<h1>Header</h1>",
259+
"<p>Paragraph 1</p>",
260+
"<p>Click me out</p>",
261+
"<p></p>",
262+
"<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
263+
"</p><p style=\"text-align:center\">Stylish Para 1</p>",
264+
"<p style=\"color:red\">Stylish Para 2</p>",
265+
""}).collect(Collectors.joining("\n")),
266+
apply(new HtmlPolicyBuilder()
267+
.allowCommonInlineFormattingElements()
268+
.allowCommonBlockElements()
269+
.allowStyling(CssSchema.withProperties(
270+
List.of("color", "text-align")))
271+
.allowStyling( // union allowed style properties
272+
CssSchema.withProperties(List.of("font-size")))
273+
.allowStandardUrlProtocols()));
274+
}
275+
276+
@Test
277+
public void testCustomPropertyStyleFilterung() {
278+
assertEquals(
279+
Arrays.stream(new String[] {
280+
"<h1>Header</h1>",
281+
"<p>Paragraph 1</p>",
282+
"<p>Click me out</p>",
283+
"<p></p>",
284+
"<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
285+
"</p><p style=\"text-align:center\">Stylish Para 1</p>",
286+
"<p>Stylish Para 2</p>",
287+
""}).collect(Collectors.joining("\n")),
288+
apply(new HtmlPolicyBuilder()
289+
.allowCommonInlineFormattingElements()
290+
.allowCommonBlockElements()
291+
.allowStyling(
292+
CssSchema.withProperties(
293+
Map.of("text-align",
294+
new CssSchema.Property(0,
295+
Set.of("center"),
296+
Collections.emptyMap()))))
297+
.allowStandardUrlProtocols()));
298+
}
299+
300+
@Test
301+
public void testCustomPropertyStyleFilterungDisallowed() {
302+
assertEquals(
303+
Arrays.stream(new String[] {
304+
"<h1>Header</h1>",
305+
"<p>Paragraph 1</p>",
306+
"<p>Click me out</p>",
307+
"<p></p>",
308+
"<p><b>Fancy</b> with <i><b>soupy</b></i><b> tags</b>.",
309+
"</p><p>Stylish Para 1</p>",
310+
"<p>Stylish Para 2</p>",
311+
""}).collect(Collectors.joining("\n")),
312+
apply(new HtmlPolicyBuilder()
313+
.allowCommonInlineFormattingElements()
314+
.allowCommonBlockElements()
315+
.allowStyling(
316+
CssSchema.withProperties(
317+
Map.of("text-align",
318+
new CssSchema.Property(0,
319+
Set.of("left", "right"),
320+
Collections.emptyMap()))))
321+
.allowStandardUrlProtocols()));
322+
}
323+
232324
@Test
233325
public static final void testElementTransforming() {
234326
assertEquals(
@@ -289,6 +381,25 @@ public static final void testAllowUrlProtocols() {
289381
.allowUrlProtocols("http")));
290382
}
291383

384+
@Test
385+
public static final void testDisallowUrlProtocols() {
386+
assertEquals(
387+
Arrays.stream(new String[] {
388+
"Header",
389+
"Paragraph 1",
390+
"Click me out",
391+
"<img src=\"canary.png\" alt=\"local-canary\" />",
392+
"Fancy with soupy tags.",
393+
"Stylish Para 1",
394+
"Stylish Para 2",
395+
""}).collect(Collectors.joining("\n")),
396+
apply(new HtmlPolicyBuilder()
397+
.allowElements("img")
398+
.allowAttributes("src", "alt").onElements("img")
399+
.allowUrlProtocols("http", "https")
400+
.disallowUrlProtocols("http")));
401+
}
402+
292403
@Test
293404
public static final void testPossibleFalloutFromIssue5() {
294405
assertEquals(
@@ -434,6 +545,55 @@ public static final void testUrlChecksLayer() {
434545
);
435546
}
436547

548+
@Test
549+
public static final void testAllowProtocolRelativeUrls() {
550+
FilterUrlByProtocolAttributePolicy attributePolicy =
551+
new FilterUrlByProtocolAttributePolicy(List.of("http", "https"));
552+
attributePolicy.allowProtocolRelativeUrls();
553+
554+
assertEquals(
555+
""
556+
+ "Mailto link\n"
557+
+ "<a href=\"http://example.com/\">Link</a>\n"
558+
+ "<a href=\"https://example.com/\">Link</a>\n"
559+
+ "<a href=\"//example.com/\">Link</a>\n",
560+
apply(
561+
new HtmlPolicyBuilder()
562+
.allowElements("a")
563+
.allowAttributes("href")
564+
.matching(attributePolicy)
565+
.onElements("a")
566+
.allowUrlProtocols("https", "http"),
567+
""
568+
+ "<a href=\"mailto:example@example.com/\">Mailto link</a>\n"
569+
+ "<a href=\"http://example.com/\">Link</a>\n"
570+
+ "<a href=\"https://example.com/\">Link</a>\n"
571+
+ "<a href=\"//example.com/\">Link</a>\n"
572+
)
573+
);
574+
575+
assertEquals(
576+
""
577+
+ "Mailto link\n"
578+
+ "Link\n"
579+
+ "<a href=\"https://example.com/\">Link</a>\n"
580+
+ "Link\n",
581+
apply(
582+
new HtmlPolicyBuilder()
583+
.allowElements("a")
584+
.allowAttributes("href")
585+
.matching(attributePolicy)
586+
.onElements("a")
587+
.allowUrlProtocols("https"),
588+
""
589+
+ "<a href=\"mailto:example@example.com/\">Mailto link</a>\n"
590+
+ "<a href=\"http://example.com/\">Link</a>\n"
591+
+ "<a href=\"https://example.com/\">Link</a>\n"
592+
+ "<a href=\"//example.com/\">Link</a>\n"
593+
)
594+
);
595+
}
596+
437597
@Test
438598
public static final void testDuplicateAttributesDoNotReachElementPolicy() {
439599
final int[] idCount = new int[1];
@@ -913,6 +1073,42 @@ public static final void testDirLi() {
9131073
"<dir compact=\"compact\"><li>something</li></dir>"));
9141074
}
9151075

1076+
@Test
1077+
public void testDisallowTextIn() {
1078+
HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder()
1079+
.allowElements("div")
1080+
.allowAttributes("style").onElements("div");
1081+
1082+
PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory();
1083+
assertEquals("<div style=\"display:node\">Some Text</div>",
1084+
allowPolicy.sanitize("<div style=\"display:node\">Some Text</div>"));
1085+
1086+
PolicyFactory disallowTextPolicy =
1087+
sharedPolicyBuilder.disallowTextIn("div").toFactory();
1088+
assertEquals("<div style=\"display:node\"></div>",
1089+
disallowTextPolicy.sanitize(
1090+
"<div style=\"display:node\">Some Text</div>"));
1091+
}
1092+
1093+
@Test
1094+
public void testDisallowAttribute() {
1095+
HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder()
1096+
.allowElements("div", "p")
1097+
.allowAttributes("style").onElements("div", "p");
1098+
1099+
PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory();
1100+
assertEquals(
1101+
"<p style=\"display:node\">Some</p><div style=\"display:node\">Text</div>",
1102+
allowPolicy.sanitize(
1103+
"<p style=\"display:node\">Some</p><div style=\"display:node\">Text</div>"));
1104+
1105+
PolicyFactory disallowTextPolicy =
1106+
sharedPolicyBuilder.disallowAttributes("style").onElements("p").toFactory();
1107+
assertEquals("<p>Some</p><div style=\"display:node\">Text</div>",
1108+
disallowTextPolicy.sanitize(
1109+
"<p style=\"display:node\">Some</p><div style=\"display:node\">Text</div>"));
1110+
}
1111+
9161112
@Test
9171113
public static void testScriptTagWithCommentBlockContainingHtmlCommentEnd() {
9181114
PolicyFactory scriptSanitizer = new HtmlPolicyBuilder()

‎src/test/java/org/owasp/html/SanitizersTest.java

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,58 @@ public static final void testImages() {
157157
);
158158
}
159159

160+
@Test
161+
public static final void testIntegerAttributePolicy() {
162+
PolicyFactory s = Sanitizers.IMAGES;
163+
assertEquals(
164+
"<img src=\"x.png\" alt=\"y\" height=\"0\" border=\"0\" />",
165+
s.sanitize(
166+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=0 border=0>")
167+
);
168+
169+
assertEquals(
170+
"<img src=\"x.png\" alt=\"y\" height=\"069\" border=\"0\" />",
171+
s.sanitize(
172+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=069 border=0>")
173+
);
174+
175+
assertEquals(
176+
"<img src=\"x.png\" alt=\"y\" height=\"64\" border=\"0\" />",
177+
s.sanitize(
178+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=64.43 border=0>")
179+
);
180+
181+
assertEquals(
182+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
183+
s.sanitize(
184+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=-64 border=0>")
185+
);
186+
187+
assertEquals(
188+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
189+
s.sanitize(
190+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=\"\" border=0>")
191+
);
192+
193+
assertEquals(
194+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
195+
s.sanitize(
196+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=.43 border=0>")
197+
);
198+
199+
assertEquals(
200+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
201+
s.sanitize(
202+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=something border=0>")
203+
);
204+
205+
assertEquals(
206+
"<img src=\"x.png\" alt=\"y\" border=\"0\" />",
207+
s.sanitize(
208+
"<img src=\"x.png\" alt=\"y\" width=\"widgy\" height=596thin border=0>")
209+
);
210+
}
211+
160212
@Test
161213
public static final void testLinks() {
162214
PolicyFactory s = Sanitizers.LINKS;

0 commit comments

Comments
 (0)