392 lines
12 KiB
JavaScript
392 lines
12 KiB
JavaScript
/**
|
|
* tests for custom method
|
|
*
|
|
* @author Zongmin Lei<leizongmin@gmail.com>
|
|
*/
|
|
|
|
var assert = require("assert");
|
|
var xss = require("../");
|
|
var debug = require("debug")("xss:test");
|
|
|
|
describe("test custom XSS method", function() {
|
|
it("#onTag - match tag", function() {
|
|
var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onTag: function(tag, html, options) {
|
|
debug(arguments);
|
|
i++;
|
|
if (i === 1) {
|
|
assert.equal(tag, "a");
|
|
assert.equal(html, '<a href="#">');
|
|
assert.equal(options.isClosing, false);
|
|
assert.equal(options.position, 2);
|
|
assert.equal(options.sourcePosition, 2);
|
|
assert.equal(options.isWhite, true);
|
|
} else if (i === 2) {
|
|
assert.equal(tag, "b");
|
|
assert.equal(html, "<b>");
|
|
assert.equal(options.isClosing, false);
|
|
assert.equal(options.position, 14);
|
|
assert.equal(options.sourcePosition, 14);
|
|
assert.equal(options.isWhite, true);
|
|
} else if (i === 3) {
|
|
assert.equal(tag, "c");
|
|
assert.equal(html, "<c>");
|
|
assert.equal(options.isClosing, false);
|
|
assert.equal(options.position, 17);
|
|
assert.equal(options.sourcePosition, 17);
|
|
assert.equal(options.isWhite, false);
|
|
} else if (i === 4) {
|
|
assert.equal(tag, "c");
|
|
assert.equal(html, "</c>");
|
|
assert.equal(options.isClosing, true);
|
|
assert.equal(options.position, 30);
|
|
assert.equal(options.sourcePosition, 24);
|
|
assert.equal(options.isWhite, false);
|
|
} else if (i === 5) {
|
|
assert.equal(tag, "b");
|
|
assert.equal(html, "</b>");
|
|
assert.equal(options.isClosing, true);
|
|
assert.equal(options.position, 40);
|
|
assert.equal(options.sourcePosition, 28);
|
|
assert.equal(options.isWhite, true);
|
|
} else if (i === 6) {
|
|
assert.equal(tag, "a");
|
|
assert.equal(html, "</a>");
|
|
assert.equal(options.isClosing, true);
|
|
assert.equal(options.position, 44);
|
|
assert.equal(options.sourcePosition, 32);
|
|
assert.equal(options.isWhite, true);
|
|
} else if (i === 7) {
|
|
assert.equal(tag, "br");
|
|
assert.equal(html, "<br>");
|
|
assert.equal(options.isClosing, false);
|
|
assert.equal(options.position, 48);
|
|
assert.equal(options.sourcePosition, 36);
|
|
assert.equal(options.isWhite, true);
|
|
} else {
|
|
throw new Error();
|
|
}
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(
|
|
html,
|
|
'dd<a href="#"><b><c>haha</c></b></a><br>ff'
|
|
);
|
|
});
|
|
|
|
it("#onTag - return new html", function() {
|
|
var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onTag: function(tag, html, options) {
|
|
debug(html);
|
|
return html;
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, source);
|
|
});
|
|
|
|
it("#onIgnoreTag - match tag", function() {
|
|
var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onIgnoreTag: function(tag, html, options) {
|
|
debug(arguments);
|
|
i++;
|
|
if (i === 1) {
|
|
assert.equal(tag, "c");
|
|
assert.equal(html, "<c>");
|
|
assert.equal(options.isClosing, false);
|
|
assert.equal(options.position, 17);
|
|
assert.equal(options.sourcePosition, 17);
|
|
assert.equal(options.isWhite, false);
|
|
} else if (i === 2) {
|
|
assert.equal(tag, "c");
|
|
assert.equal(html, "</c>");
|
|
assert.equal(options.isClosing, true);
|
|
assert.equal(options.position, 30);
|
|
assert.equal(options.sourcePosition, 24);
|
|
assert.equal(options.isWhite, false);
|
|
} else {
|
|
throw new Error();
|
|
}
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(
|
|
html,
|
|
'dd<a href="#"><b><c>haha</c></b></a><br>ff'
|
|
);
|
|
});
|
|
|
|
it("#onIgnoreTag - return new html", function() {
|
|
var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onIgnoreTag: function(tag, html, options) {
|
|
debug(html);
|
|
return "[" + (options.isClosing ? "/" : "") + "removed]";
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(
|
|
html,
|
|
'dd<a href="#"><b>[removed]haha[/removed]</b></a><br>ff'
|
|
);
|
|
});
|
|
|
|
it("#onTagAttr - match attr", function() {
|
|
var source =
|
|
'<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onTagAttr: function(tag, name, value, isWhiteAttr) {
|
|
debug(arguments);
|
|
assert.equal(tag, "a");
|
|
i++;
|
|
if (i === 1) {
|
|
assert.equal(name, "href");
|
|
assert.equal(value, "#");
|
|
assert.equal(isWhiteAttr, true);
|
|
} else if (i === 2) {
|
|
assert.equal(name, "target");
|
|
assert.equal(value, "_blank");
|
|
assert.equal(isWhiteAttr, true);
|
|
} else if (i === 3) {
|
|
assert.equal(name, "checked");
|
|
assert.equal(value, "");
|
|
assert.equal(isWhiteAttr, false);
|
|
} else if (i === 4) {
|
|
assert.equal(name, "data-a");
|
|
assert.equal(value, "b");
|
|
assert.equal(isWhiteAttr, false);
|
|
} else {
|
|
throw new Error();
|
|
}
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, '<a href="#" target="_blank">hi</a>');
|
|
});
|
|
|
|
it("#onTagAttr - match attr", function() {
|
|
var source =
|
|
'<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onTagAttr: function(tag, name, value, isWhiteAttr) {
|
|
debug(arguments);
|
|
return "$" + name + "$";
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "<a $href$ $target$ $checked$ $data-a$>hi</a>");
|
|
});
|
|
|
|
it("#onIgnoreTagAttr - match attr", function() {
|
|
var source =
|
|
'<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onIgnoreTagAttr: function(tag, name, value, isWhiteAttr) {
|
|
debug(arguments);
|
|
assert.equal(tag, "a");
|
|
i++;
|
|
if (i === 1) {
|
|
assert.equal(name, "checked");
|
|
assert.equal(value, "");
|
|
assert.equal(isWhiteAttr, false);
|
|
} else if (i === 2) {
|
|
assert.equal(name, "data-a");
|
|
assert.equal(value, "b");
|
|
assert.equal(isWhiteAttr, false);
|
|
} else {
|
|
throw new Error();
|
|
}
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, '<a href="#" target="_blank">hi</a>');
|
|
});
|
|
|
|
it("#onIgnoreTagAttr - match attr", function() {
|
|
var source =
|
|
'<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onIgnoreTagAttr: function(tag, name, value, isWhiteAttr) {
|
|
debug(arguments);
|
|
return "$" + name + "$";
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, '<a href="#" target="_blank" $checked$ $data-a$>hi</a>');
|
|
});
|
|
|
|
it("#escapeHtml - default", function() {
|
|
var source = "<x>yy</x><a>bb</a>";
|
|
var html = xss(source);
|
|
debug(html);
|
|
assert.equal(html, "<x>yy</x><a>bb</a>");
|
|
});
|
|
|
|
it("#escapeHtml - return new value", function() {
|
|
var source = "<x>yy</x><a>bb</a>";
|
|
var html = xss(source, {
|
|
escapeHtml: function(str) {
|
|
return str ? "[" + str + "]" : str;
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "[<x>][yy][</x>]<a>[bb]</a>");
|
|
});
|
|
|
|
it("#safeAttrValue - default", function() {
|
|
var source = '<a href="javascript:alert(/xss/)" title="hi">link</a>';
|
|
var html = xss(source);
|
|
debug(html);
|
|
assert.equal(html, '<a href title="hi">link</a>');
|
|
});
|
|
|
|
it("#safeAttrValue - return new value", function() {
|
|
var source = '<a href="javascript:alert(/xss/)" title="hi">link</a>';
|
|
var html = xss(source, {
|
|
safeAttrValue: function(tag, name, value) {
|
|
debug(arguments);
|
|
assert.equal(tag, "a");
|
|
return "$" + name + "$";
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, '<a href="$href$" title="$title$">link</a>');
|
|
});
|
|
|
|
it("#stripIgnoreTag", function() {
|
|
var source = "<x>yy</x><a>bb</a>";
|
|
var html = xss(source, {
|
|
stripIgnoreTag: true
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "yy<a>bb</a>");
|
|
});
|
|
|
|
it("#stripTagBody - true", function() {
|
|
var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
|
|
var html = xss(source, {
|
|
stripIgnoreTagBody: true
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "<a>link</a>bk");
|
|
});
|
|
|
|
it("#stripIgnoreTagBody - *", function() {
|
|
var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
|
|
var html = xss(source, {
|
|
stripIgnoreTagBody: "*"
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "<a>link</a>bk");
|
|
});
|
|
|
|
it("#stripIgnoreTagBody - ['x']", function() {
|
|
var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
|
|
var html = xss(source, {
|
|
stripIgnoreTagBody: ["x"]
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "<a>link</a><y>a<y></y>b</y>k");
|
|
});
|
|
|
|
it("#stripIgnoreTagBody - ['x'] & onIgnoreTag", function() {
|
|
var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
|
|
var html = xss(source, {
|
|
stripIgnoreTagBody: ["x"],
|
|
onIgnoreTag: function(tag, html, options) {
|
|
return "$" + tag + "$";
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "<a>link</a>$y$a$y$$y$b$y$k");
|
|
});
|
|
|
|
it("#stripIgnoreTag & stripIgnoreTagBody", function() {
|
|
var source = "<scri" + "pt>alert(/xss/);</scri" + "pt>";
|
|
var html = xss(source, {
|
|
stripIgnoreTag: true,
|
|
stripIgnoreTagBody: ["script"]
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "");
|
|
});
|
|
|
|
it("#stripIgnoreTag & stripIgnoreTagBody - 2", function() {
|
|
var source = "ooxx<scri" + "pt>alert(/xss/);</scri" + "pt>";
|
|
var html = xss(source, {
|
|
stripIgnoreTag: true,
|
|
stripIgnoreTagBody: ["script"]
|
|
});
|
|
debug(html);
|
|
assert.equal(html, "ooxx");
|
|
});
|
|
|
|
it("cssFilter", function() {
|
|
var whiteList = xss.getDefaultWhiteList();
|
|
whiteList.div.push("style");
|
|
assert.equal(
|
|
xss('<div style="width: 50%; vertical-align: top;">hello</div>', {
|
|
whiteList: whiteList
|
|
}),
|
|
'<div style="width:50%;">hello</div>'
|
|
);
|
|
assert.equal(
|
|
xss('<div style="width: 50%; vertical-align: top;">hello</div>', {
|
|
whiteList: whiteList,
|
|
css: false
|
|
}),
|
|
'<div style="width: 50%; vertical-align: top;">hello</div>'
|
|
);
|
|
var css = { whiteList: xss.getDefaultCSSWhiteList() };
|
|
css.whiteList["vertical-align"] = true;
|
|
assert.equal(
|
|
xss('<div style="width: 50%; vertical-align: top;">hello</div>', {
|
|
whiteList: whiteList,
|
|
css: css
|
|
}),
|
|
'<div style="width:50%; vertical-align:top;">hello</div>'
|
|
);
|
|
});
|
|
|
|
it("#onTag - sanitize html parameter space", function() {
|
|
var source = '<a target= " href="><script>alert(2)</script>"><span>';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onTag: function(_, E, S) {
|
|
if (S.isWhite && "a" === _) {
|
|
if (S.isClosing) return "</span></a>";
|
|
return "".concat(E, '<span>');
|
|
}
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, '<a target= " href="><span><script>alert(2)</script>"><span>');
|
|
});
|
|
|
|
it("#onTag - sanitize html parameter tab", function() {
|
|
var source = '<a target= " href="><script>alert(2)</script>"><span>';
|
|
var i = 0;
|
|
var html = xss(source, {
|
|
onTag: function(_, E, S) {
|
|
if (S.isWhite && "a" === _) {
|
|
if (S.isClosing) return "</span></a>";
|
|
return "".concat(E, '<span>');
|
|
}
|
|
}
|
|
});
|
|
debug(html);
|
|
assert.equal(html, '<a target= " href="><span><script>alert(2)</script>"><span>');
|
|
});
|
|
});
|