jeremy-RedCloth 4.1.1
Sign up to get free protection for your applications and to get access to all the features.
- data/CHANGELOG +135 -0
- data/COPYING +18 -0
- data/Manifest +56 -0
- data/README +171 -0
- data/Rakefile +205 -0
- data/bin/redcloth +28 -0
- data/ext/mingw-rbconfig.rb +176 -0
- data/ext/redcloth_scan/extconf.rb +9 -0
- data/ext/redcloth_scan/redcloth.h +178 -0
- data/ext/redcloth_scan/redcloth_attributes.c.rl +56 -0
- data/ext/redcloth_scan/redcloth_attributes.java.rl +96 -0
- data/ext/redcloth_scan/redcloth_attributes.rl +33 -0
- data/ext/redcloth_scan/redcloth_common.c.rl +18 -0
- data/ext/redcloth_scan/redcloth_common.java.rl +18 -0
- data/ext/redcloth_scan/redcloth_common.rl +111 -0
- data/ext/redcloth_scan/redcloth_inline.c.rl +159 -0
- data/ext/redcloth_scan/redcloth_inline.java.rl +108 -0
- data/ext/redcloth_scan/redcloth_inline.rl +159 -0
- data/ext/redcloth_scan/redcloth_scan.c.rl +237 -0
- data/ext/redcloth_scan/redcloth_scan.java.rl +573 -0
- data/ext/redcloth_scan/redcloth_scan.rl +325 -0
- data/extras/ragel_profiler.rb +73 -0
- data/lib/case_sensitive_require/RedCloth.rb +6 -0
- data/lib/redcloth.rb +37 -0
- data/lib/redcloth/erb_extension.rb +27 -0
- data/lib/redcloth/formatters/base.rb +57 -0
- data/lib/redcloth/formatters/html.rb +353 -0
- data/lib/redcloth/formatters/latex.rb +275 -0
- data/lib/redcloth/formatters/latex_entities.yml +2414 -0
- data/lib/redcloth/textile_doc.rb +103 -0
- data/lib/redcloth/version.rb +28 -0
- data/setup.rb +1585 -0
- data/test/basic.yml +922 -0
- data/test/code.yml +229 -0
- data/test/definitions.yml +82 -0
- data/test/extra_whitespace.yml +64 -0
- data/test/filter_html.yml +177 -0
- data/test/filter_pba.yml +20 -0
- data/test/helper.rb +108 -0
- data/test/html.yml +311 -0
- data/test/images.yml +254 -0
- data/test/instiki.yml +38 -0
- data/test/links.yml +275 -0
- data/test/lists.yml +283 -0
- data/test/poignant.yml +89 -0
- data/test/sanitize_html.yml +42 -0
- data/test/table.yml +336 -0
- data/test/test_custom_tags.rb +58 -0
- data/test/test_erb.rb +13 -0
- data/test/test_extensions.rb +31 -0
- data/test/test_formatters.rb +24 -0
- data/test/test_parser.rb +73 -0
- data/test/test_restrictions.rb +41 -0
- data/test/textism.yml +480 -0
- data/test/threshold.yml +772 -0
- data/test/validate_fixtures.rb +74 -0
- metadata +133 -0
data/test/code.yml
ADDED
|
@@ -0,0 +1,229 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: inline code
|
|
3
|
+
in: 'This is an empty dictionary: @{}@'
|
|
4
|
+
html: '<p>This is an empty dictionary: <code>{}</code></p>'
|
|
5
|
+
---
|
|
6
|
+
name: inline code escapement
|
|
7
|
+
in: 'Please type @cat "file.txt" > otherfile.txt@ at the prompt.'
|
|
8
|
+
html: '<p>Please type <code>cat "file.txt" > otherfile.txt</code> at the prompt.</p>'
|
|
9
|
+
---
|
|
10
|
+
name: inline code escapement with digits
|
|
11
|
+
in: |-
|
|
12
|
+
Regex-based string substitution with Ruby's gsub!: @"123<789".gsub!(/</, "") => "123789"@
|
|
13
|
+
html: |-
|
|
14
|
+
<p>Regex-based string substitution with Ruby’s gsub!: <code>"123<789".gsub!(/</, "") => "123789"</code></p>
|
|
15
|
+
---
|
|
16
|
+
name: inlne code escapement describing textile paragraph styling
|
|
17
|
+
in: 'This paragraph is aligned left but if you add this: @p>.@ to the beginning it will be aligned right.'
|
|
18
|
+
html: '<p>This paragraph is aligned left but if you add this: <code>p>.</code> to the beginning it will be aligned right.</p>'
|
|
19
|
+
---
|
|
20
|
+
name: escapes code snippet containing html tag
|
|
21
|
+
in: 'At the top of each page, please put @<h2>Title</h2>@ in the HTML.'
|
|
22
|
+
html: '<p>At the top of each page, please put <code><h2>Title</h2></code> in the <span class="caps">HTML</span>.</p>'
|
|
23
|
+
---
|
|
24
|
+
name: escaping in blockcode
|
|
25
|
+
in: 'bc. This is within a block of code, so < and > should be entities. You can talk about a <p class="foo"> tag if you wish and it will be properly escaped.'
|
|
26
|
+
html: '<pre><code>This is within a block of code, so < and > should be entities. You can talk about a <p class="foo"> tag if you wish and it will be properly escaped.</code></pre>'
|
|
27
|
+
---
|
|
28
|
+
name: escaping in pre
|
|
29
|
+
in: '<pre><code>This is within a block of code, so < and > should be entities. You can talk about a <p class="foo"> tag in pre tags too.</code></pre>'
|
|
30
|
+
html: '<pre><code>This is within a block of code, so < and > should be entities. You can talk about a <p class="foo"> tag in pre tags too.</code></pre>'
|
|
31
|
+
---
|
|
32
|
+
name: escaping in normal text
|
|
33
|
+
in: |-
|
|
34
|
+
This is a regular paragraph. AT&T. £38 > $38.
|
|
35
|
+
html: |-
|
|
36
|
+
<p>This is a regular paragraph. AT&T. £38 > $38.</p>
|
|
37
|
+
latex: "This is a regular paragraph. AT\\&T. \\pounds{}38 \\textgreater{} \\$38.\n\n"
|
|
38
|
+
---
|
|
39
|
+
name: preservation of existing entities
|
|
40
|
+
in: "Math fact: 3 < 5 & 5 > 3 but £6 > $6. Oh, and 2 ÷ 4 is ½."
|
|
41
|
+
html: "<p>Math fact: 3 < 5 & 5 > 3 but £6 > $6. Oh, and 2 ÷ 4 is ½.</p>"
|
|
42
|
+
latex: "Math fact: 3 \\textless{} 5 \\& 5 \\textgreater{} 3 but \\pounds{}6 \\textgreater{} \\$6. Oh, and 2 \\textdiv{} 4 is \\sfrac{1}{2}.\n\n"
|
|
43
|
+
---
|
|
44
|
+
name: escaping of existing entities in blockcode
|
|
45
|
+
in: "bc. Math fact: 3 < 5 & 5 > 3 but £5 > $5."
|
|
46
|
+
html: "<pre><code>Math fact: 3 &lt; 5 &amp; 5 &gt; 3 but &pound;5 &#62; $5.</code></pre>"
|
|
47
|
+
latex: "\\begin{verbatim}\nMath fact: 3 < 5 & 5 > 3 but £5 > $5.\\end{verbatim}\n"
|
|
48
|
+
---
|
|
49
|
+
name: no formatting within pre
|
|
50
|
+
in: |-
|
|
51
|
+
<pre>
|
|
52
|
+
<code>
|
|
53
|
+
# *test*
|
|
54
|
+
__not italics__
|
|
55
|
+
no hard breaks
|
|
56
|
+
</code>
|
|
57
|
+
</pre>
|
|
58
|
+
html: |-
|
|
59
|
+
<pre>
|
|
60
|
+
<code>
|
|
61
|
+
# *test*
|
|
62
|
+
__not italics__
|
|
63
|
+
no hard breaks
|
|
64
|
+
</code>
|
|
65
|
+
</pre>
|
|
66
|
+
---
|
|
67
|
+
name: no formatting within blockcode
|
|
68
|
+
in: |-
|
|
69
|
+
bc. __not italics__
|
|
70
|
+
html: |-
|
|
71
|
+
<pre><code>__not italics__</code></pre>
|
|
72
|
+
---
|
|
73
|
+
name: double-equals as inline notextile
|
|
74
|
+
in: |-
|
|
75
|
+
p. Regular paragraph
|
|
76
|
+
|
|
77
|
+
==Escaped portion -- will not be formatted by Textile at all==
|
|
78
|
+
|
|
79
|
+
p. Back to normal.
|
|
80
|
+
html: |-
|
|
81
|
+
<p>Regular paragraph</p>
|
|
82
|
+
<p>Escaped portion -- will not be formatted by Textile at all</p>
|
|
83
|
+
<p>Back to normal.</p>
|
|
84
|
+
---
|
|
85
|
+
name: notextile tags
|
|
86
|
+
in: |-
|
|
87
|
+
<notextile>
|
|
88
|
+
# *test*
|
|
89
|
+
</notextile>
|
|
90
|
+
html: |-
|
|
91
|
+
# *test*
|
|
92
|
+
valid_html: false
|
|
93
|
+
---
|
|
94
|
+
name: unfinished notextile tag
|
|
95
|
+
in: |-
|
|
96
|
+
<notextile>
|
|
97
|
+
# *test*
|
|
98
|
+
html: |-
|
|
99
|
+
# *test*
|
|
100
|
+
valid_html: false
|
|
101
|
+
---
|
|
102
|
+
name: unfinished script tag
|
|
103
|
+
in: |-
|
|
104
|
+
<script>
|
|
105
|
+
function main(){}
|
|
106
|
+
html: |-
|
|
107
|
+
<script><br />
|
|
108
|
+
function main(){}
|
|
109
|
+
valid_html: false
|
|
110
|
+
---
|
|
111
|
+
name: inline notextile tags
|
|
112
|
+
in: 'This is how you make a link: <notextile>"link":http://www.redcloth.org</notextile>'
|
|
113
|
+
html: '<p>This is how you make a link: "link":http://www.redcloth.org</p>'
|
|
114
|
+
---
|
|
115
|
+
name: code in list items
|
|
116
|
+
in: |-
|
|
117
|
+
* @foo@
|
|
118
|
+
* @bar@
|
|
119
|
+
* and @x@ is also.
|
|
120
|
+
|
|
121
|
+
html: |-
|
|
122
|
+
<ul>
|
|
123
|
+
<li><code>foo</code></li>
|
|
124
|
+
<li><code>bar</code></li>
|
|
125
|
+
<li>and <code>x</code> is also.</li>
|
|
126
|
+
</ul>
|
|
127
|
+
---
|
|
128
|
+
name: extended block code
|
|
129
|
+
in: |-
|
|
130
|
+
If you have a line or two of code or HTML to embed, use extended block code like so:
|
|
131
|
+
|
|
132
|
+
bc.. ./foo.pl%
|
|
133
|
+
<p>foo outputs an HTML paragraph</p>
|
|
134
|
+
|
|
135
|
+
<p>block of code keeps going until a different block signature is encountered</p>
|
|
136
|
+
|
|
137
|
+
p. And then go back with a normal paragraph.
|
|
138
|
+
html: |-
|
|
139
|
+
<p>If you have a line or two of code or <span class="caps">HTML</span> to embed, use extended block code like so:</p>
|
|
140
|
+
<pre><code>./foo.pl%
|
|
141
|
+
<p>foo outputs an HTML paragraph</p></code>
|
|
142
|
+
|
|
143
|
+
<code><p>block of code keeps going until a different block signature is encountered</p></code>
|
|
144
|
+
|
|
145
|
+
</pre>
|
|
146
|
+
<p>And then go back with a normal paragraph.</p>
|
|
147
|
+
---
|
|
148
|
+
name: extended block code preserves leading whitespace after blank line
|
|
149
|
+
in: |-
|
|
150
|
+
bc.. class Foo
|
|
151
|
+
def bar
|
|
152
|
+
'bar'
|
|
153
|
+
end
|
|
154
|
+
|
|
155
|
+
def baz
|
|
156
|
+
'baz'
|
|
157
|
+
end
|
|
158
|
+
end
|
|
159
|
+
|
|
160
|
+
p. That's it!
|
|
161
|
+
html: |-
|
|
162
|
+
<pre><code>class Foo
|
|
163
|
+
def bar
|
|
164
|
+
'bar'
|
|
165
|
+
end</code>
|
|
166
|
+
|
|
167
|
+
<code> def baz
|
|
168
|
+
'baz'
|
|
169
|
+
end
|
|
170
|
+
end</code>
|
|
171
|
+
|
|
172
|
+
</pre>
|
|
173
|
+
<p>That’s it!</p>
|
|
174
|
+
---
|
|
175
|
+
name: block code containing code avoids nesting code tags
|
|
176
|
+
in: |-
|
|
177
|
+
bc. A one-liner: @ruby -ne '($h||={}).fetch($_){puts $h[$_]=$_}'@
|
|
178
|
+
html: |-
|
|
179
|
+
<pre><code>A one-liner: @ruby -ne '($h||={}).fetch($_){puts $h[$_]=$_}'@</code></pre>
|
|
180
|
+
---
|
|
181
|
+
name: block code containing block start
|
|
182
|
+
in: |-
|
|
183
|
+
bc. I saw a ship. It ate my elephant.
|
|
184
|
+
html: |-
|
|
185
|
+
<pre><code>I saw a ship. It ate my elephant.</code></pre>
|
|
186
|
+
---
|
|
187
|
+
name: extended block code containing block start
|
|
188
|
+
in: |-
|
|
189
|
+
bc.. This is an extended bc.
|
|
190
|
+
|
|
191
|
+
I saw a ship. It ate my elephant.
|
|
192
|
+
html: |-
|
|
193
|
+
<pre><code>This is an extended bc.</code>
|
|
194
|
+
|
|
195
|
+
<code>I saw a ship. It ate my elephant.</code></pre>
|
|
196
|
+
---
|
|
197
|
+
name: block containing html tags
|
|
198
|
+
in: bc. Can I talk about <h2>Headings</h2> here?
|
|
199
|
+
html: '<pre><code>Can I talk about <h2>Headings</h2> here?</code></pre>'
|
|
200
|
+
---
|
|
201
|
+
name: escape latex standard symbols
|
|
202
|
+
in: "standard symbols # $ % & _ { }"
|
|
203
|
+
latex: "standard symbols \\# \\$ \\% \\& \\_ \\{ \\}\n\n"
|
|
204
|
+
---
|
|
205
|
+
name: escape latex text symbols
|
|
206
|
+
in: "text symbols \\ ~ ^"
|
|
207
|
+
latex: "text symbols \\textbackslash{} \\~{} \\^{}\n\n"
|
|
208
|
+
---
|
|
209
|
+
name: named html entities to latex
|
|
210
|
+
in: "… ½"
|
|
211
|
+
latex: "\ldots{} \sfrac{1}{2}\n\n"
|
|
212
|
+
---
|
|
213
|
+
name: numeric html entities to latex
|
|
214
|
+
in: "… ½"
|
|
215
|
+
latex: "\ldots{} \sfrac{1}{2}\n\n"
|
|
216
|
+
---
|
|
217
|
+
name: unclosed pre tag
|
|
218
|
+
in: '<pre><code>This is a pre that will go unfinished'
|
|
219
|
+
html: '<pre><code>This is a pre that will go unfinished'
|
|
220
|
+
valid_html: false
|
|
221
|
+
---
|
|
222
|
+
name: unclosed code tag
|
|
223
|
+
in: 'This is a some <code>code that will go unfinished'
|
|
224
|
+
html: '<p>This is a some <code>code that will go unfinished</p>'
|
|
225
|
+
valid_html: false
|
|
226
|
+
---
|
|
227
|
+
name: code containing parentheses
|
|
228
|
+
in: 'p. @some_method(some_params, some => test);@ Oh dear this fails'
|
|
229
|
+
html: '<p><code>some_method(some_params, some => test);</code> Oh dear this fails</p>'
|
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
name: redcloth definition list
|
|
2
|
+
in: |-
|
|
3
|
+
here is a RedCloth definition list:
|
|
4
|
+
|
|
5
|
+
- yes := no
|
|
6
|
+
- no:=no
|
|
7
|
+
- maybe:= yes
|
|
8
|
+
html: |-
|
|
9
|
+
<p>here is a RedCloth definition list:</p>
|
|
10
|
+
<dl>
|
|
11
|
+
<dt>yes</dt>
|
|
12
|
+
<dd>no</dd>
|
|
13
|
+
<dt>no</dt>
|
|
14
|
+
<dd>no</dd>
|
|
15
|
+
<dt>maybe</dt>
|
|
16
|
+
<dd>yes</dd>
|
|
17
|
+
</dl>
|
|
18
|
+
---
|
|
19
|
+
name: with line breaks
|
|
20
|
+
in: |-
|
|
21
|
+
- term := you can have line breaks
|
|
22
|
+
just like other lists
|
|
23
|
+
- line-spanning
|
|
24
|
+
term := hey, slick!
|
|
25
|
+
html: |-
|
|
26
|
+
<dl>
|
|
27
|
+
<dt>term</dt>
|
|
28
|
+
<dd>you can have line breaks<br />
|
|
29
|
+
just like other lists</dd>
|
|
30
|
+
<dt>line-spanning<br />
|
|
31
|
+
term</dt>
|
|
32
|
+
<dd>hey, slick!</dd>
|
|
33
|
+
</dl>
|
|
34
|
+
---
|
|
35
|
+
name: double terms
|
|
36
|
+
in: |-
|
|
37
|
+
You can have multiple terms before a definition:
|
|
38
|
+
|
|
39
|
+
- textile
|
|
40
|
+
- fabric
|
|
41
|
+
- cloth := woven threads
|
|
42
|
+
html: |-
|
|
43
|
+
<p>You can have multiple terms before a definition:</p>
|
|
44
|
+
<dl>
|
|
45
|
+
<dt>textile</dt>
|
|
46
|
+
<dt>fabric</dt>
|
|
47
|
+
<dt>cloth</dt>
|
|
48
|
+
<dd>woven threads</dd>
|
|
49
|
+
</dl>
|
|
50
|
+
---
|
|
51
|
+
name: not a definition list
|
|
52
|
+
desc: a definition list with no definitions is not a definition list
|
|
53
|
+
in: |-
|
|
54
|
+
- textile
|
|
55
|
+
- fabric
|
|
56
|
+
- cloth
|
|
57
|
+
html: |-
|
|
58
|
+
<p>- textile<br />
|
|
59
|
+
- fabric<br />
|
|
60
|
+
- cloth</p>
|
|
61
|
+
---
|
|
62
|
+
name: long definition list
|
|
63
|
+
in: |-
|
|
64
|
+
here is a long definition
|
|
65
|
+
|
|
66
|
+
- some term :=
|
|
67
|
+
*sweet*
|
|
68
|
+
|
|
69
|
+
yes
|
|
70
|
+
|
|
71
|
+
ok =:
|
|
72
|
+
- regular term := no
|
|
73
|
+
html: |-
|
|
74
|
+
<p>here is a long definition</p>
|
|
75
|
+
<dl>
|
|
76
|
+
<dt>some term</dt>
|
|
77
|
+
<dd><p><strong>sweet</strong></p>
|
|
78
|
+
<p>yes</p>
|
|
79
|
+
<p>ok</p></dd>
|
|
80
|
+
<dt>regular term</dt>
|
|
81
|
+
<dd>no</dd>
|
|
82
|
+
</dl>
|
|
@@ -0,0 +1,64 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: header with 1 blank line below
|
|
3
|
+
in: |-
|
|
4
|
+
h1. Header
|
|
5
|
+
|
|
6
|
+
text
|
|
7
|
+
html: |-
|
|
8
|
+
<h1>Header</h1>
|
|
9
|
+
<p>text</p>
|
|
10
|
+
---
|
|
11
|
+
name: header with 2 blank lines below
|
|
12
|
+
in: |-
|
|
13
|
+
h1. Header
|
|
14
|
+
|
|
15
|
+
|
|
16
|
+
text
|
|
17
|
+
html: |-
|
|
18
|
+
<h1>Header</h1>
|
|
19
|
+
<p>text</p>
|
|
20
|
+
---
|
|
21
|
+
name: header with 1 blank line above
|
|
22
|
+
in: |-
|
|
23
|
+
text
|
|
24
|
+
|
|
25
|
+
h1. Header
|
|
26
|
+
html: |-
|
|
27
|
+
<p>text</p>
|
|
28
|
+
<h1>Header</h1>
|
|
29
|
+
---
|
|
30
|
+
name: header with 2 blank lines above
|
|
31
|
+
in: |-
|
|
32
|
+
text
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
h1. Header
|
|
36
|
+
html: |-
|
|
37
|
+
<p>text</p>
|
|
38
|
+
<h1>Header</h1>
|
|
39
|
+
---
|
|
40
|
+
name: header with 1 blank line above and with no text
|
|
41
|
+
in: |-
|
|
42
|
+
|
|
43
|
+
h1. Header
|
|
44
|
+
html: <h1>Header</h1>
|
|
45
|
+
---
|
|
46
|
+
name: header with 2 blank lines above and with no text
|
|
47
|
+
in: |-
|
|
48
|
+
|
|
49
|
+
|
|
50
|
+
h1. Header
|
|
51
|
+
html: <h1>Header</h1>
|
|
52
|
+
---
|
|
53
|
+
name: header with 1 blank line below and with no text
|
|
54
|
+
in: |+
|
|
55
|
+
h1. Header
|
|
56
|
+
|
|
57
|
+
html: <h1>Header</h1>
|
|
58
|
+
---
|
|
59
|
+
name: header with 2 blank lines below and with no text
|
|
60
|
+
in: |+
|
|
61
|
+
h1. Header
|
|
62
|
+
|
|
63
|
+
|
|
64
|
+
html: <h1>Header</h1>
|
|
@@ -0,0 +1,177 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: standalone html escaped
|
|
3
|
+
in: |-
|
|
4
|
+
<hr>
|
|
5
|
+
<abc def="a=1&b=2">
|
|
6
|
+
<div>
|
|
7
|
+
<hr/>
|
|
8
|
+
<hr />
|
|
9
|
+
</div>
|
|
10
|
+
filtered_html: |-
|
|
11
|
+
<hr>
|
|
12
|
+
<abc def="a=1&b=2">
|
|
13
|
+
<div>
|
|
14
|
+
<hr/>
|
|
15
|
+
<hr />
|
|
16
|
+
</div>
|
|
17
|
+
---
|
|
18
|
+
in: Just a little harmless xss <script src=http://ha.ckers.org/xss.js></script>
|
|
19
|
+
filtered_html: <p>Just a little harmless xss <script src=http://ha.ckers.org/xss.js></script></p>
|
|
20
|
+
---
|
|
21
|
+
name: escapes partial inline script tag
|
|
22
|
+
desc: The end tag is malformed, but it must be escaped since a browser would recognize it
|
|
23
|
+
in: Just a little harmless xss <script src=http://ha.ckers.org/xss.js></script
|
|
24
|
+
filtered_html: <p>Just a little harmless xss <script src=http://ha.ckers.org/xss.js></script</p>
|
|
25
|
+
valid_html: false
|
|
26
|
+
---
|
|
27
|
+
name: escapes partial scanner-level script tag
|
|
28
|
+
desc: The end tag is malformed, but it must be escaped since a browser would recognize it anyway.
|
|
29
|
+
in: <script src=http://ha.ckers.org/xss.js></script
|
|
30
|
+
filtered_html: '<script src=http://ha.ckers.org/xss.js></script'
|
|
31
|
+
valid_html: false
|
|
32
|
+
---
|
|
33
|
+
name: escapes self-closing scanner-level tag
|
|
34
|
+
in: <hr />
|
|
35
|
+
filtered_html: '<hr />'
|
|
36
|
+
valid_html: false
|
|
37
|
+
---
|
|
38
|
+
name: processes text beginning with space
|
|
39
|
+
in: ' This should be <b>escaped</b>: <script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script>'
|
|
40
|
+
filtered_html: 'This should be <b>escaped</b>: <script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script>'
|
|
41
|
+
---
|
|
42
|
+
name: processes script tags beginning with space
|
|
43
|
+
in: ' <script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script>'
|
|
44
|
+
filtered_html: '<script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script>'
|
|
45
|
+
---
|
|
46
|
+
name: processes text in notextile tags
|
|
47
|
+
in: |-
|
|
48
|
+
<notextile>
|
|
49
|
+
This should be <b>escaped</b>: <script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script>
|
|
50
|
+
</notextile>
|
|
51
|
+
filtered_html: |-
|
|
52
|
+
This should be <b>escaped</b>: <script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script>
|
|
53
|
+
---
|
|
54
|
+
name: processes text in inline notextile tags
|
|
55
|
+
in: |-
|
|
56
|
+
This should be <b>escaped</b>: <notextile><script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script></notextile>
|
|
57
|
+
filtered_html: |-
|
|
58
|
+
<p>This should be <b>escaped</b>: <script type="text/javascript">alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");</script></p>
|
|
59
|
+
---
|
|
60
|
+
name: escapes script tags
|
|
61
|
+
in: |-
|
|
62
|
+
<script type="text/javascript">
|
|
63
|
+
alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");
|
|
64
|
+
</script>
|
|
65
|
+
filtered_html: |-
|
|
66
|
+
<script type="text/javascript">
|
|
67
|
+
alert("Hai. I`m in ya PC. Makin ya XSS viruzz! KThxBye");
|
|
68
|
+
</script>
|
|
69
|
+
---
|
|
70
|
+
name: escapes HTML entities within script tags
|
|
71
|
+
in: |-
|
|
72
|
+
<script type="text/javascript">
|
|
73
|
+
<!--
|
|
74
|
+
document.write("Hello World!")
|
|
75
|
+
//-->
|
|
76
|
+
</script>
|
|
77
|
+
filtered_html: |-
|
|
78
|
+
<script type="text/javascript">
|
|
79
|
+
<!--
|
|
80
|
+
document.write("Hello World!")
|
|
81
|
+
//-->
|
|
82
|
+
</script>
|
|
83
|
+
---
|
|
84
|
+
name: escapes inline html tags
|
|
85
|
+
in: |-
|
|
86
|
+
p. Letting people inject their own HTML can be <em>dangerous</em>!.
|
|
87
|
+
filtered_html: |-
|
|
88
|
+
<p>Letting people inject their own <span class="caps">HTML</span> can be <em>dangerous</em>!.</p>
|
|
89
|
+
---
|
|
90
|
+
name: escapes html in comments
|
|
91
|
+
in: |-
|
|
92
|
+
p. You can't have people injecting HTML into <!-- <b>comments</b>! -->.
|
|
93
|
+
filtered_html: |-
|
|
94
|
+
<p>You can’t have people injecting <span class="caps">HTML</span> into <!-- <b>comments</b>! -->.</p>
|
|
95
|
+
---
|
|
96
|
+
name: escapes html in inline code tags
|
|
97
|
+
in: |-
|
|
98
|
+
p. I have some <code><em>awesome</em> code</code> here.
|
|
99
|
+
filtered_html: |-
|
|
100
|
+
<p>I have some <code><em>awesome</em> code</code> here.</p>
|
|
101
|
+
---
|
|
102
|
+
name: escapes html notextile block
|
|
103
|
+
in: |-
|
|
104
|
+
notextile. This is a <em>notextile</em> block.
|
|
105
|
+
filtered_html: |-
|
|
106
|
+
This is a <em>notextile</em> block.
|
|
107
|
+
---
|
|
108
|
+
name: escapes html in pre tags
|
|
109
|
+
in: |-
|
|
110
|
+
<pre>
|
|
111
|
+
This should be <em>escaped</em>.
|
|
112
|
+
</pre>
|
|
113
|
+
filtered_html: |-
|
|
114
|
+
<pre>
|
|
115
|
+
This should be <em>escaped</em>.
|
|
116
|
+
</pre>
|
|
117
|
+
---
|
|
118
|
+
name: escapes html
|
|
119
|
+
in: |-
|
|
120
|
+
<div>This should be escaped</div>
|
|
121
|
+
filtered_html: |-
|
|
122
|
+
<div>This should be escaped</div>
|
|
123
|
+
---
|
|
124
|
+
name: escapes html in html
|
|
125
|
+
in: |-
|
|
126
|
+
<div>This should be <b>bold</b></div>
|
|
127
|
+
filtered_html: |-
|
|
128
|
+
<div>This should be <b>bold</b></div>
|
|
129
|
+
---
|
|
130
|
+
in: Here's a bad image <img src="JaVaScRiPt:alert('XSS');">
|
|
131
|
+
filtered_html: <p>Here’s a bad image <img src="JaVaScRiPt:alert('XSS');"></p>
|
|
132
|
+
---
|
|
133
|
+
in: Just some random > and < characters, but also a <br/> tag.
|
|
134
|
+
filtered_html: <p>Just some random > and < characters, but also a <br/> tag.</p>
|
|
135
|
+
---
|
|
136
|
+
in: |-
|
|
137
|
+
Quotes outside "pre" tags are escaped.
|
|
138
|
+
|
|
139
|
+
<a href="test">Tags are completely escaped outside pre tags.</a>
|
|
140
|
+
|
|
141
|
+
<pre>
|
|
142
|
+
<code>
|
|
143
|
+
# only < and > are escaped inside pre tags. "Quotes" remain.
|
|
144
|
+
|
|
145
|
+
<div>
|
|
146
|
+
a = 1
|
|
147
|
+
</div>
|
|
148
|
+
|
|
149
|
+
Bad code here.
|
|
150
|
+
|
|
151
|
+
<script language="JavaScript">
|
|
152
|
+
window.open( "abfiltered_html:blank" );
|
|
153
|
+
</script>
|
|
154
|
+
</code>
|
|
155
|
+
</pre>
|
|
156
|
+
|
|
157
|
+
filtered_html: |-
|
|
158
|
+
<p>Quotes outside “pre” tags are escaped.</p>
|
|
159
|
+
<p><a href="test">Tags are completely escaped outside pre tags.</a></p>
|
|
160
|
+
<pre>
|
|
161
|
+
<code>
|
|
162
|
+
# only < and > are escaped inside pre tags. "Quotes" remain.
|
|
163
|
+
|
|
164
|
+
<div>
|
|
165
|
+
a = 1
|
|
166
|
+
</div>
|
|
167
|
+
|
|
168
|
+
Bad code here.
|
|
169
|
+
|
|
170
|
+
<script language="JavaScript">
|
|
171
|
+
window.open( "abfiltered_html:blank" );
|
|
172
|
+
</script>
|
|
173
|
+
</code>
|
|
174
|
+
</pre>
|
|
175
|
+
---
|
|
176
|
+
in: /me <3 beer
|
|
177
|
+
filtered_html: <p>/me <3 beer</p>
|