sanitize-6.0.0/ 0000755 0000041 0000041 00000000000 14107642052 013374 5 ustar www-data www-data sanitize-6.0.0/test/ 0000755 0000041 0000041 00000000000 14107642052 014353 5 ustar www-data www-data sanitize-6.0.0/test/test_malicious_css.rb 0000644 0000041 0000041 00000002355 14107642052 020601 0 ustar www-data www-data # encoding: utf-8
require_relative 'common'
# Miscellaneous attempts to sneak maliciously crafted CSS past Sanitize. Some of
# these are courtesy of (or inspired by) the OWASP XSS Filter Evasion Cheat
# Sheet.
#
# https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
describe 'Malicious CSS' do
make_my_diffs_pretty!
parallelize_me!
before do
@s = Sanitize::CSS.new(Sanitize::Config::RELAXED)
end
it 'should not be possible to inject an expression by munging it with a comment' do
@s.properties(%[width:expr/*XSS*/ession(alert('XSS'))]).
must_equal ''
@s.properties(%[width:ex/*XSS*//*/*/pression(alert("XSS"))]).
must_equal ''
end
it 'should not be possible to inject an expression by munging it with a newline' do
@s.properties(%[width:\nexpression(alert('XSS'));]).
must_equal ''
end
it 'should not allow the javascript protocol' do
@s.properties(%[background-image:url("javascript:alert('XSS')");]).
must_equal ''
Sanitize.fragment(%[
],
Sanitize::Config::RELAXED).must_equal '
'
end
it 'should not allow behaviors' do
@s.properties(%[behavior: url(xss.htc);]).must_equal ''
end
end
sanitize-6.0.0/test/common.rb 0000644 0000041 0000041 00000000120 14107642052 016161 0 ustar www-data www-data # encoding: utf-8
require 'minitest/autorun'
require_relative '../lib/sanitize'
sanitize-6.0.0/test/test_clean_comment.rb 0000644 0000041 0000041 00000003670 14107642052 020551 0 ustar www-data www-data # encoding: utf-8
require_relative 'common'
describe 'Sanitize::Transformers::CleanComment' do
make_my_diffs_pretty!
parallelize_me!
describe 'when :allow_comments is false' do
before do
@s = Sanitize.new(:allow_comments => false, :elements => ['div'])
end
it 'should remove comments' do
@s.fragment('foo bar').must_equal 'foo bar'
@s.fragment('foo bar").must_equal 'foo bar'
@s.fragment("foo --> -->bar").must_equal 'foo --> -->bar'
@s.fragment("foo
>bar
").must_equal 'foo
>bar
'
# Special case: the comment markup is inside a ").must_equal ''
Sanitize.fragment("", :allow_comments => false, :elements => ['script'])
.must_equal ''
end
end
describe 'when :allow_comments is true' do
before do
@s = Sanitize.new(:allow_comments => true, :elements => ['div'])
end
it 'should allow comments' do
@s.fragment('foo bar').must_equal 'foo bar'
@s.fragment('foo '
@s.fragment('foo '
@s.fragment("foo bar").must_equal "foo bar"
@s.fragment("foo --> -->bar").must_equal 'foo --> -->bar'
@s.fragment("foo
>bar
").must_equal 'foo
>bar
'
Sanitize.fragment("", :allow_comments => true, :elements => ['script'])
.must_equal ''
end
end
end
sanitize-6.0.0/test/test_clean_css.rb 0000644 0000041 0000041 00000003224 14107642052 017672 0 ustar www-data www-data # encoding: utf-8
require_relative 'common'
describe 'Sanitize::Transformers::CSS::CleanAttribute' do
make_my_diffs_pretty!
parallelize_me!
before do
@s = Sanitize.new(Sanitize::Config::RELAXED)
end
it 'should sanitize CSS properties in style attributes' do
@s.fragment(%[
].strip).must_equal %[
].strip
end
it 'should remove the style attribute if the sanitized CSS is empty' do
@s.fragment('
').
must_equal '
'
end
end
describe 'Sanitize::Transformers::CSS::CleanElement' do
make_my_diffs_pretty!
parallelize_me!
before do
@s = Sanitize.new(Sanitize::Config::RELAXED)
end
it 'should sanitize CSS stylesheets in
].strip
@s.fragment(html).must_equal %[
].strip
end
it 'should remove the ').must_equal ''
end
end
sanitize-6.0.0/test/test_config.rb 0000644 0000041 0000041 00000003614 14107642052 017210 0 ustar www-data www-data # encoding: utf-8
require_relative 'common'
describe 'Config' do
make_my_diffs_pretty!
parallelize_me!
def verify_deeply_frozen(config)
config.must_be :frozen?
if Hash === config
config.each_value {|v| verify_deeply_frozen(v) }
elsif Set === config || Array === config
config.each {|v| verify_deeply_frozen(v) }
end
end
it 'built-in configs should be deeply frozen' do
verify_deeply_frozen Sanitize::Config::DEFAULT
verify_deeply_frozen Sanitize::Config::BASIC
verify_deeply_frozen Sanitize::Config::RELAXED
verify_deeply_frozen Sanitize::Config::RESTRICTED
end
describe '.freeze_config' do
it 'should deeply freeze and return a configuration Hash' do
a = {:one => {:one_one => [0, '1', :a], :one_two => false, :one_three => Set.new([:a, :b, :c])}}
b = Sanitize::Config.freeze_config(a)
b.must_be_same_as a
verify_deeply_frozen a
end
end
describe '.merge' do
it 'should deeply merge a configuration Hash' do
# Freeze to ensure that we get an error if either Hash is modified.
a = Sanitize::Config.freeze_config({:one => {:one_one => [0, '1', :a], :one_two => false, :one_three => Set.new([:a, :b, :c])}})
b = Sanitize::Config.freeze_config({:one => {:one_two => true, :one_three => 3}, :two => 2})
c = Sanitize::Config.merge(a, b)
c.wont_be_same_as a
c.wont_be_same_as b
c.must_equal(
:one => {
:one_one => [0, '1', :a],
:one_two => true,
:one_three => 3
},
:two => 2
)
c[:one].wont_be_same_as a[:one]
c[:one][:one_one].wont_be_same_as a[:one][:one_one]
end
it 'should raise an ArgumentError if either argument is not a Hash' do
proc { Sanitize::Config.merge('foo', {}) }.must_raise ArgumentError
proc { Sanitize::Config.merge({}, 'foo') }.must_raise ArgumentError
end
end
end
sanitize-6.0.0/test/test_malicious_html.rb 0000644 0000041 0000041 00000021036 14107642052 020752 0 ustar www-data www-data # encoding: utf-8
require_relative 'common'
# Miscellaneous attempts to sneak maliciously crafted HTML past Sanitize. Many
# of these are courtesy of (or inspired by) the OWASP XSS Filter Evasion Cheat
# Sheet.
#
# https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
describe 'Malicious HTML' do
make_my_diffs_pretty!
parallelize_me!
before do
@s = Sanitize.new(Sanitize::Config::RELAXED)
end
describe 'comments' do
it 'should not allow script injection via conditional comments' do
@s.fragment(%[]).
must_equal ''
end
end
describe 'interpolation (ERB, PHP, etc.)' do
it 'should escape ERB-style tags' do
@s.fragment('<% naughty_ruby_code %>').
must_equal '<% naughty_ruby_code %>'
@s.fragment('<%= naughty_ruby_code %>').
must_equal '<%= naughty_ruby_code %>'
end
it 'should remove PHP-style tags' do
@s.fragment(' naughtyPHPCode(); ?>').
must_equal ''
@s.fragment('= naughtyPHPCode(); ?>').
must_equal ''
end
end
describe '' do
it 'should not be possible to inject JS via a malformed event attribute' do
@s.document('').
must_equal ""
end
end
describe '