diff --git a/src/test/java/org/owasp/html/CssSchemaTest.java b/src/test/java/org/owasp/html/CssSchemaTest.java
index 91c6a792..e3b8e2f9 100644
--- a/src/test/java/org/owasp/html/CssSchemaTest.java
+++ b/src/test/java/org/owasp/html/CssSchemaTest.java
@@ -55,6 +55,9 @@ public static final void testDangerousProperties() {
// Prefix corner cases.
"-",
"-moz-",
+ "-ms-",
+ "-o-",
+ "-webkit-",
}) {
assertSame(key, CssSchema.DISALLOWED, CssSchema.DEFAULT.forKey(key));
}
diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
index f19b28d6..e541de77 100644
--- a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
+++ b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java
@@ -229,6 +229,48 @@ public static final void testStyleFiltering() {
.allowStandardUrlProtocols()));
}
+ @Test
+ public void testSpecificStyleFilterung() {
+ assertEquals(
+ Arrays.stream(new String[] {
+ "
Header
",
+ "Paragraph 1
",
+ "Click me out
",
+ "",
+ "Fancy with soupy tags.",
+ "
Stylish Para 1
",
+ "Stylish Para 2
",
+ ""}).collect(Collectors.joining("\n")),
+ apply(new HtmlPolicyBuilder()
+ .allowCommonInlineFormattingElements()
+ .allowCommonBlockElements()
+ .allowStyling(CssSchema.withProperties(
+ List.of("color", "text-align", "font-size")))
+ .allowStandardUrlProtocols()));
+ }
+
+ @Test
+ public void testUnionStyleFilterung() {
+ assertEquals(
+ Arrays.stream(new String[] {
+ "Header
",
+ "Paragraph 1
",
+ "Click me out
",
+ "",
+ "Fancy with soupy tags.",
+ "
Stylish Para 1
",
+ "Stylish Para 2
",
+ ""}).collect(Collectors.joining("\n")),
+ apply(new HtmlPolicyBuilder()
+ .allowCommonInlineFormattingElements()
+ .allowCommonBlockElements()
+ .allowStyling(CssSchema.withProperties(
+ List.of("color", "text-align")))
+ .allowStyling( // union allowed style properties
+ CssSchema.withProperties(List.of("font-size")))
+ .allowStandardUrlProtocols()));
+ }
+
@Test
public static final void testElementTransforming() {
assertEquals(
@@ -289,6 +331,25 @@ public static final void testAllowUrlProtocols() {
.allowUrlProtocols("http")));
}
+ @Test
+ public static final void testDisallowUrlProtocols() {
+ assertEquals(
+ Arrays.stream(new String[] {
+ "Header",
+ "Paragraph 1",
+ "Click me out",
+ "
",
+ "Fancy with soupy tags.",
+ "Stylish Para 1",
+ "Stylish Para 2",
+ ""}).collect(Collectors.joining("\n")),
+ apply(new HtmlPolicyBuilder()
+ .allowElements("img")
+ .allowAttributes("src", "alt").onElements("img")
+ .allowUrlProtocols("http", "https")
+ .disallowUrlProtocols("http")));
+ }
+
@Test
public static final void testPossibleFalloutFromIssue5() {
assertEquals(
@@ -847,6 +908,52 @@ public static final void testEmptyDefaultLinkRelsSet() {
pf.sanitize("eg"));
}
+ @Test
+ public static final void testRequireAndSkipRels() {
+ PolicyFactory pf = new HtmlPolicyBuilder()
+ .allowElements("a")
+ .allowAttributes("href", "target").onElements("a")
+ .allowStandardUrlProtocols()
+ .requireRelsOnLinks("noreferrer")
+ .skipRelsOnLinks("noopener", "noreferrer")
+ .toFactory();
+
+ assertEquals(
+ "eg",
+ pf.sanitize("eg"));
+
+ assertEquals(
+ "eg",
+ pf.sanitize("eg"));
+
+ assertEquals(
+ "eg",
+ pf.sanitize("eg"));
+ }
+
+ @Test
+ public static final void testSkipAndRequireRels() {
+ PolicyFactory pf = new HtmlPolicyBuilder()
+ .allowElements("a")
+ .allowAttributes("href", "target").onElements("a")
+ .allowStandardUrlProtocols()
+ .skipRelsOnLinks("noopener", "noreferrer")
+ .requireRelsOnLinks("noreferrer")
+ .toFactory();
+
+ assertEquals(
+ "eg",
+ pf.sanitize("eg"));
+
+ assertEquals(
+ "eg",
+ pf.sanitize("eg"));
+
+ assertEquals(
+ "eg",
+ pf.sanitize("eg"));
+ }
+
@Test
public static final void testExplicitRelsSkip() {
PolicyFactory pf = new HtmlPolicyBuilder()
@@ -913,6 +1020,64 @@ public static final void testDirLi() {
"something"));
}
+ @Test
+ public void testDisallowTextIn() {
+ HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder()
+ .allowElements("div")
+ .allowAttributes("style").onElements("div");
+
+ PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory();
+ assertEquals("Some Text
",
+ allowPolicy.sanitize("Some Text
"));
+
+ PolicyFactory disallowTextPolicy =
+ sharedPolicyBuilder.disallowTextIn("div").toFactory();
+ assertEquals("",
+ disallowTextPolicy.sanitize(
+ "Some Text
"));
+ }
+
+ @Test
+ public void testDisallowAttribute() {
+ HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder()
+ .allowElements("div", "p")
+ .allowAttributes("style").onElements("div", "p");
+
+ PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory();
+ assertEquals(
+ "Some
Text
",
+ allowPolicy.sanitize(
+ "Some
Text
"));
+
+ PolicyFactory disallowTextPolicy =
+ sharedPolicyBuilder.disallowAttributes("style").onElements("p").toFactory();
+ assertEquals("Some
Text
",
+ disallowTextPolicy.sanitize(
+ "Some
Text
"));
+ }
+
+ @Test
+ public void testCreativeCSSStyling() {
+ PolicyFactory policy = new HtmlPolicyBuilder()
+ .allowElements("p")
+ .allowAttributes("style").onElements("p").allowStyling().toFactory();
+
+ assertEquals("Some
",
+ policy.sanitize("Some
"));
+
+ assertEquals("Some
",
+ policy.sanitize("Some
"));
+
+ assertEquals("Some
",
+ policy.sanitize("Some
"));
+
+ assertEquals("Some
",
+ policy.sanitize("Some
"));
+
+ assertEquals("Some
",
+ policy.sanitize("Some
"));
+ }
+
@Test
public static void testScriptTagWithCommentBlockContainingHtmlCommentEnd() {
PolicyFactory scriptSanitizer = new HtmlPolicyBuilder()
diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/src/test/java/org/owasp/html/SanitizersTest.java
index 66f0d661..5cdadace 100644
--- a/src/test/java/org/owasp/html/SanitizersTest.java
+++ b/src/test/java/org/owasp/html/SanitizersTest.java
@@ -157,6 +157,58 @@ public static final void testImages() {
);
}
+ @Test
+ public static final void testIntegerAttributePolicy() {
+ PolicyFactory s = Sanitizers.IMAGES;
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+
+ assertEquals(
+ "
",
+ s.sanitize(
+ "
")
+ );
+ }
+
@Test
public static final void testLinks() {
PolicyFactory s = Sanitizers.LINKS;