diff --git a/src/test/java/org/owasp/html/CssSchemaTest.java b/src/test/java/org/owasp/html/CssSchemaTest.java index 91c6a792..e3b8e2f9 100644 --- a/src/test/java/org/owasp/html/CssSchemaTest.java +++ b/src/test/java/org/owasp/html/CssSchemaTest.java @@ -55,6 +55,9 @@ public static final void testDangerousProperties() { // Prefix corner cases. "-", "-moz-", + "-ms-", + "-o-", + "-webkit-", }) { assertSame(key, CssSchema.DISALLOWED, CssSchema.DEFAULT.forKey(key)); } diff --git a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java index f19b28d6..e541de77 100644 --- a/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java +++ b/src/test/java/org/owasp/html/HtmlPolicyBuilderTest.java @@ -229,6 +229,48 @@ public static final void testStyleFiltering() { .allowStandardUrlProtocols())); } + @Test + public void testSpecificStyleFilterung() { + assertEquals( + Arrays.stream(new String[] { + "

Header

", + "

Paragraph 1

", + "

Click me out

", + "

", + "

Fancy with soupy tags.", + "

Stylish Para 1

", + "

Stylish Para 2

", + ""}).collect(Collectors.joining("\n")), + apply(new HtmlPolicyBuilder() + .allowCommonInlineFormattingElements() + .allowCommonBlockElements() + .allowStyling(CssSchema.withProperties( + List.of("color", "text-align", "font-size"))) + .allowStandardUrlProtocols())); + } + + @Test + public void testUnionStyleFilterung() { + assertEquals( + Arrays.stream(new String[] { + "

Header

", + "

Paragraph 1

", + "

Click me out

", + "

", + "

Fancy with soupy tags.", + "

Stylish Para 1

", + "

Stylish Para 2

", + ""}).collect(Collectors.joining("\n")), + apply(new HtmlPolicyBuilder() + .allowCommonInlineFormattingElements() + .allowCommonBlockElements() + .allowStyling(CssSchema.withProperties( + List.of("color", "text-align"))) + .allowStyling( // union allowed style properties + CssSchema.withProperties(List.of("font-size"))) + .allowStandardUrlProtocols())); + } + @Test public static final void testElementTransforming() { assertEquals( @@ -289,6 +331,25 @@ public static final void testAllowUrlProtocols() { .allowUrlProtocols("http"))); } + @Test + public static final void testDisallowUrlProtocols() { + assertEquals( + Arrays.stream(new String[] { + "Header", + "Paragraph 1", + "Click me out", + "\"local-canary\"", + "Fancy with soupy tags.", + "Stylish Para 1", + "Stylish Para 2", + ""}).collect(Collectors.joining("\n")), + apply(new HtmlPolicyBuilder() + .allowElements("img") + .allowAttributes("src", "alt").onElements("img") + .allowUrlProtocols("http", "https") + .disallowUrlProtocols("http"))); + } + @Test public static final void testPossibleFalloutFromIssue5() { assertEquals( @@ -847,6 +908,52 @@ public static final void testEmptyDefaultLinkRelsSet() { pf.sanitize("eg")); } + @Test + public static final void testRequireAndSkipRels() { + PolicyFactory pf = new HtmlPolicyBuilder() + .allowElements("a") + .allowAttributes("href", "target").onElements("a") + .allowStandardUrlProtocols() + .requireRelsOnLinks("noreferrer") + .skipRelsOnLinks("noopener", "noreferrer") + .toFactory(); + + assertEquals( + "eg", + pf.sanitize("eg")); + + assertEquals( + "eg", + pf.sanitize("eg")); + + assertEquals( + "eg", + pf.sanitize("eg")); + } + + @Test + public static final void testSkipAndRequireRels() { + PolicyFactory pf = new HtmlPolicyBuilder() + .allowElements("a") + .allowAttributes("href", "target").onElements("a") + .allowStandardUrlProtocols() + .skipRelsOnLinks("noopener", "noreferrer") + .requireRelsOnLinks("noreferrer") + .toFactory(); + + assertEquals( + "eg", + pf.sanitize("eg")); + + assertEquals( + "eg", + pf.sanitize("eg")); + + assertEquals( + "eg", + pf.sanitize("eg")); + } + @Test public static final void testExplicitRelsSkip() { PolicyFactory pf = new HtmlPolicyBuilder() @@ -913,6 +1020,64 @@ public static final void testDirLi() { "
  • something
  • ")); } + @Test + public void testDisallowTextIn() { + HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder() + .allowElements("div") + .allowAttributes("style").onElements("div"); + + PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory(); + assertEquals("
    Some Text
    ", + allowPolicy.sanitize("
    Some Text
    ")); + + PolicyFactory disallowTextPolicy = + sharedPolicyBuilder.disallowTextIn("div").toFactory(); + assertEquals("
    ", + disallowTextPolicy.sanitize( + "
    Some Text
    ")); + } + + @Test + public void testDisallowAttribute() { + HtmlPolicyBuilder sharedPolicyBuilder = new HtmlPolicyBuilder() + .allowElements("div", "p") + .allowAttributes("style").onElements("div", "p"); + + PolicyFactory allowPolicy = sharedPolicyBuilder.toFactory(); + assertEquals( + "

    Some

    Text
    ", + allowPolicy.sanitize( + "

    Some

    Text
    ")); + + PolicyFactory disallowTextPolicy = + sharedPolicyBuilder.disallowAttributes("style").onElements("p").toFactory(); + assertEquals("

    Some

    Text
    ", + disallowTextPolicy.sanitize( + "

    Some

    Text
    ")); + } + + @Test + public void testCreativeCSSStyling() { + PolicyFactory policy = new HtmlPolicyBuilder() + .allowElements("p") + .allowAttributes("style").onElements("p").allowStyling().toFactory(); + + assertEquals("

    Some

    ", + policy.sanitize("

    Some

    ")); + + assertEquals("

    Some

    ", + policy.sanitize("

    Some

    ")); + + assertEquals("

    Some

    ", + policy.sanitize("

    Some

    ")); + + assertEquals("

    Some

    ", + policy.sanitize("

    Some

    ")); + + assertEquals("

    Some

    ", + policy.sanitize("

    Some

    ")); + } + @Test public static void testScriptTagWithCommentBlockContainingHtmlCommentEnd() { PolicyFactory scriptSanitizer = new HtmlPolicyBuilder() diff --git a/src/test/java/org/owasp/html/SanitizersTest.java b/src/test/java/org/owasp/html/SanitizersTest.java index 66f0d661..5cdadace 100644 --- a/src/test/java/org/owasp/html/SanitizersTest.java +++ b/src/test/java/org/owasp/html/SanitizersTest.java @@ -157,6 +157,58 @@ public static final void testImages() { ); } + @Test + public static final void testIntegerAttributePolicy() { + PolicyFactory s = Sanitizers.IMAGES; + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + + assertEquals( + "\"y\"", + s.sanitize( + "\"y\"") + ); + } + @Test public static final void testLinks() { PolicyFactory s = Sanitizers.LINKS;