loofah 0.2.2 → 0.3.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of loofah might be problematic. Click here for more details.
- data.tar.gz.sig +0 -0
- data/CHANGELOG.rdoc +14 -0
- data/DEPRECATED.rdoc +12 -0
- data/Manifest.txt +6 -5
- data/README.rdoc +86 -20
- data/Rakefile +38 -0
- data/benchmark/benchmark.rb +117 -37
- data/benchmark/helper.rb +36 -0
- data/lib/loofah.rb +7 -5
- data/lib/loofah/active_record.rb +28 -4
- data/lib/loofah/helpers.rb +23 -0
- data/lib/loofah/xss_foliate.rb +210 -0
- data/test/test_active_record.rb +69 -27
- data/test/test_ad_hoc.rb +185 -0
- data/test/test_helpers.rb +28 -0
- data/test/test_xss_foliate.rb +171 -0
- metadata +16 -17
- metadata.gz.sig +0 -0
- data/lib/loofah/deprecated.rb +0 -38
- data/test/html5/test_deprecated_sanitizer.rb +0 -185
- data/test/test_deprecated_basic.rb +0 -68
- data/test/test_microsofty.rb +0 -91
- data/test/test_strip_tags.rb +0 -36
@@ -1,68 +0,0 @@
|
|
1
|
-
require File.expand_path(File.join(File.dirname(__FILE__), 'helper'))
|
2
|
-
|
3
|
-
class TestDeprecatedBasic < Test::Unit::TestCase
|
4
|
-
|
5
|
-
def test_empty_string
|
6
|
-
assert_equal "", Loofah.sanitize("")
|
7
|
-
end
|
8
|
-
|
9
|
-
def test_removal_of_illegal_tag
|
10
|
-
html = <<-HTML
|
11
|
-
following this there should be no jim tag
|
12
|
-
<jim>jim</jim>
|
13
|
-
was there?
|
14
|
-
HTML
|
15
|
-
sane = Nokogiri::HTML(Loofah.sanitize(html))
|
16
|
-
assert sane.xpath("//jim").empty?
|
17
|
-
end
|
18
|
-
|
19
|
-
def test_removal_of_illegal_attribute
|
20
|
-
html = "<p class=bar foo=bar abbr=bar />"
|
21
|
-
sane = Nokogiri::HTML(Loofah.sanitize(html))
|
22
|
-
node = sane.xpath("//p").first
|
23
|
-
assert node.attributes['class']
|
24
|
-
assert node.attributes['abbr']
|
25
|
-
assert_nil node.attributes['foo']
|
26
|
-
end
|
27
|
-
|
28
|
-
def test_removal_of_illegal_url_in_href
|
29
|
-
html = <<-HTML
|
30
|
-
<a href='jimbo://jim.jim/'>this link should have its href removed because of illegal url</a>
|
31
|
-
<a href='http://jim.jim/'>this link should be fine</a>
|
32
|
-
HTML
|
33
|
-
sane = Nokogiri::HTML(Loofah.sanitize(html))
|
34
|
-
nodes = sane.xpath("//a")
|
35
|
-
assert_nil nodes.first.attributes['href']
|
36
|
-
assert nodes.last.attributes['href']
|
37
|
-
end
|
38
|
-
|
39
|
-
def test_css_sanitization
|
40
|
-
html = "<p style='background-color: url(\"http://foo.com/\") ; background-color: #000 ;' />"
|
41
|
-
sane = Nokogiri::HTML(Loofah.sanitize(html))
|
42
|
-
assert_match(/#000/, sane.inner_html)
|
43
|
-
assert_no_match(/foo\.com/, sane.inner_html)
|
44
|
-
end
|
45
|
-
|
46
|
-
def test_fragment_with_no_tags
|
47
|
-
assert_equal "This fragment has no tags.", Loofah.sanitize("This fragment has no tags.")
|
48
|
-
end
|
49
|
-
|
50
|
-
def test_fragment_in_p_tag
|
51
|
-
assert_equal "<p>This fragment is in a p.</p>", Loofah.sanitize("<p>This fragment is in a p.</p>")
|
52
|
-
end
|
53
|
-
|
54
|
-
def test_fragment_in_p_tag_plus_stuff
|
55
|
-
assert_equal "<p>This fragment is in a p.</p>foo<strong>bar</strong>", Loofah.sanitize("<p>This fragment is in a p.</p>foo<strong>bar</strong>")
|
56
|
-
end
|
57
|
-
|
58
|
-
def test_fragment_with_text_nodes_leading_and_trailing
|
59
|
-
assert_equal "text<p>fragment</p>text", Loofah.sanitize("text<p>fragment</p>text")
|
60
|
-
end
|
61
|
-
|
62
|
-
def test_whitewash_on_fragment
|
63
|
-
html = "safe<frameset rows=\"*\"><frame src=\"http://example.com\"></frameset> <b>description</b>"
|
64
|
-
whitewashed = Loofah.whitewash_document(html)
|
65
|
-
assert_equal "<p>safe</p><b>description</b>", whitewashed.gsub("\n","")
|
66
|
-
end
|
67
|
-
|
68
|
-
end
|
data/test/test_microsofty.rb
DELETED
@@ -1,91 +0,0 @@
|
|
1
|
-
require File.expand_path(File.join(File.dirname(__FILE__), 'helper'))
|
2
|
-
|
3
|
-
class TestMicrosofty < Test::Unit::TestCase
|
4
|
-
|
5
|
-
MSWORD_HTML = <<-EOHTML
|
6
|
-
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="ProgId" content="Word.Document"><meta name="Generator" content="Microsoft Word 11"><meta name="Originator" content="Microsoft Word 11"><link rel="File-List" href="file:///C:%5CDOCUME%7E1%5CNICOLE%7E1%5CLOCALS%7E1%5CTemp%5Cmsohtml1%5C01%5Cclip_filelist.xml"><!--[if gte mso 9]><xml>
|
7
|
-
<w:WordDocument>
|
8
|
-
<w:View>Normal</w:View>
|
9
|
-
<w:Zoom>0</w:Zoom>
|
10
|
-
<w:PunctuationKerning/>
|
11
|
-
<w:ValidateAgainstSchemas/>
|
12
|
-
<w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
|
13
|
-
<w:IgnoreMixedContent>false</w:IgnoreMixedContent>
|
14
|
-
<w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
|
15
|
-
<w:Compatibility>
|
16
|
-
<w:BreakWrappedTables/>
|
17
|
-
<w:SnapToGridInCell/>
|
18
|
-
<w:WrapTextWithPunct/>
|
19
|
-
<w:UseAsianBreakRules/>
|
20
|
-
<w:DontGrowAutofit/>
|
21
|
-
</w:Compatibility>
|
22
|
-
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
|
23
|
-
</w:WordDocument>
|
24
|
-
</xml><![endif]--><!--[if gte mso 9]><xml>
|
25
|
-
<w:LatentStyles DefLockedState="false" LatentStyleCount="156">
|
26
|
-
</w:LatentStyles>
|
27
|
-
</xml><![endif]--><style>
|
28
|
-
<!--
|
29
|
-
/* Style Definitions */
|
30
|
-
p.MsoNormal, li.MsoNormal, div.MsoNormal
|
31
|
-
{mso-style-parent:"";
|
32
|
-
margin:0in;
|
33
|
-
margin-bottom:.0001pt;
|
34
|
-
mso-pagination:widow-orphan;
|
35
|
-
font-size:12.0pt;
|
36
|
-
font-family:"Times New Roman";
|
37
|
-
mso-fareast-font-family:"Times New Roman";}
|
38
|
-
@page Section1
|
39
|
-
{size:8.5in 11.0in;
|
40
|
-
margin:1.0in 1.25in 1.0in 1.25in;
|
41
|
-
mso-header-margin:.5in;
|
42
|
-
mso-footer-margin:.5in;
|
43
|
-
mso-paper-source:0;}
|
44
|
-
div.Section1
|
45
|
-
{page:Section1;}
|
46
|
-
-->
|
47
|
-
</style><!--[if gte mso 10]>
|
48
|
-
<style>
|
49
|
-
/* Style Definitions */
|
50
|
-
table.MsoNormalTable
|
51
|
-
{mso-style-name:"Table Normal";
|
52
|
-
mso-tstyle-rowband-size:0;
|
53
|
-
mso-tstyle-colband-size:0;
|
54
|
-
mso-style-noshow:yes;
|
55
|
-
mso-style-parent:"";
|
56
|
-
mso-padding-alt:0in 5.4pt 0in 5.4pt;
|
57
|
-
mso-para-margin:0in;
|
58
|
-
mso-para-margin-bottom:.0001pt;
|
59
|
-
mso-pagination:widow-orphan;
|
60
|
-
font-size:10.0pt;
|
61
|
-
font-family:"Times New Roman";
|
62
|
-
mso-ansi-language:#0400;
|
63
|
-
mso-fareast-language:#0400;
|
64
|
-
mso-bidi-language:#0400;}
|
65
|
-
</style>
|
66
|
-
<![endif]-->
|
67
|
-
|
68
|
-
<p class="MsoNormal">Foo <b style="">BOLD<o:p></o:p></b></p>
|
69
|
-
EOHTML
|
70
|
-
|
71
|
-
def test_deprecated_whitewash_fragment_on_microsofty_markup
|
72
|
-
whitewashed = Loofah.whitewash(MSWORD_HTML.chomp)
|
73
|
-
assert_equal "<p>Foo <b>BOLD</b></p>", whitewashed
|
74
|
-
end
|
75
|
-
|
76
|
-
def test_deprecated_whitewash_on_microsofty_markup
|
77
|
-
whitewashed = Loofah.whitewash_document(MSWORD_HTML)
|
78
|
-
assert_equal "<p>Foo <b>BOLD</b></p>", whitewashed
|
79
|
-
end
|
80
|
-
|
81
|
-
def test_fragment_whitewash_on_microsofty_markup
|
82
|
-
whitewashed = Loofah.fragment(MSWORD_HTML.chomp).scrub!(:whitewash)
|
83
|
-
assert_equal "<p>Foo <b>BOLD</b></p>", whitewashed.to_s
|
84
|
-
end
|
85
|
-
|
86
|
-
def test_document_whitewash_on_microsofty_markup
|
87
|
-
whitewashed = Loofah.document(MSWORD_HTML.chomp).scrub!(:whitewash)
|
88
|
-
assert_equal "<p>Foo <b>BOLD</b></p>", whitewashed.to_s
|
89
|
-
end
|
90
|
-
|
91
|
-
end
|
data/test/test_strip_tags.rb
DELETED
@@ -1,36 +0,0 @@
|
|
1
|
-
require File.expand_path(File.join(File.dirname(__FILE__), 'helper'))
|
2
|
-
|
3
|
-
class TestStripTags < Test::Unit::TestCase
|
4
|
-
|
5
|
-
def test_empty_string
|
6
|
-
assert_equal Loofah.strip_tags(""), ""
|
7
|
-
end
|
8
|
-
|
9
|
-
def test_return_empty_string_when_nothing_left
|
10
|
-
assert_equal "", Loofah.strip_tags('<script>test</script>')
|
11
|
-
end
|
12
|
-
|
13
|
-
def test_removal_of_all_tags
|
14
|
-
html = <<-HTML
|
15
|
-
What's up <strong>doc</strong>?
|
16
|
-
HTML
|
17
|
-
stripped = Loofah.strip_tags(html)
|
18
|
-
assert_equal "What's up doc?".strip, stripped.strip
|
19
|
-
end
|
20
|
-
|
21
|
-
def test_dont_remove_whitespace
|
22
|
-
html = "Foo\nBar"
|
23
|
-
assert_equal html, Loofah.strip_tags(html)
|
24
|
-
end
|
25
|
-
|
26
|
-
def test_dont_remove_whitespace_between_tags
|
27
|
-
html = "<p>Foo</p>\n<p>Bar</p>"
|
28
|
-
assert_equal "Foo\nBar", Loofah.strip_tags(html)
|
29
|
-
end
|
30
|
-
|
31
|
-
def test_removal_of_entities
|
32
|
-
html = "<p>this is < that "&" the other > boo'ya</p>"
|
33
|
-
assert_equal 'this is < that "&" the other > boo\'ya', Loofah.strip_tags(html)
|
34
|
-
end
|
35
|
-
|
36
|
-
end
|