loofah 2.2.3 → 2.6.0

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of loofah might be problematic. Click here for more details.

data/.gemtest DELETED
File without changes
@@ -1,186 +0,0 @@
1
- require 'set'
2
-
3
- module Loofah
4
- module HTML5 # :nodoc:
5
- #
6
- # HTML whitelist lifted from HTML5lib sanitizer code:
7
- #
8
- # http://code.google.com/p/html5lib/
9
- #
10
- # <html5_license>
11
- #
12
- # Copyright (c) 2006-2008 The Authors
13
- #
14
- # Contributors:
15
- # James Graham - jg307@cam.ac.uk
16
- # Anne van Kesteren - annevankesteren@gmail.com
17
- # Lachlan Hunt - lachlan.hunt@lachy.id.au
18
- # Matt McDonald - kanashii@kanashii.ca
19
- # Sam Ruby - rubys@intertwingly.net
20
- # Ian Hickson (Google) - ian@hixie.ch
21
- # Thomas Broyer - t.broyer@ltgt.net
22
- # Jacques Distler - distler@golem.ph.utexas.edu
23
- # Henri Sivonen - hsivonen@iki.fi
24
- # The Mozilla Foundation (contributions from Henri Sivonen since 2008)
25
- #
26
- # Permission is hereby granted, free of charge, to any person
27
- # obtaining a copy of this software and associated documentation
28
- # files (the "Software"), to deal in the Software without
29
- # restriction, including without limitation the rights to use, copy,
30
- # modify, merge, publish, distribute, sublicense, and/or sell copies
31
- # of the Software, and to permit persons to whom the Software is
32
- # furnished to do so, subject to the following conditions:
33
- #
34
- # The above copyright notice and this permission notice shall be
35
- # included in all copies or substantial portions of the Software.
36
- #
37
- # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
38
- # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
39
- # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
40
- # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
41
- # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
42
- # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
43
- # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
44
- # DEALINGS IN THE SOFTWARE.
45
- #
46
- # </html5_license>
47
- module WhiteList
48
-
49
- ACCEPTABLE_ELEMENTS = Set.new %w[a abbr acronym address area
50
- article aside audio b bdi bdo big blockquote br button canvas
51
- caption center cite code col colgroup command datalist dd del
52
- details dfn dir div dl dt em fieldset figcaption figure footer
53
- font form h1 h2 h3 h4 h5 h6 header hr i img input ins kbd label
54
- legend li main map mark menu meter nav ol output optgroup option p
55
- pre q s samp section select small span strike strong sub summary
56
- sup table tbody td textarea tfoot th thead time tr tt u ul var
57
- video]
58
-
59
- MATHML_ELEMENTS = Set.new %w[annotation annotation-xml maction math merror mfrac
60
- mfenced mi mmultiscripts mn mo mover mpadded mphantom mprescripts mroot mrow
61
- mspace msqrt mstyle msub msubsup msup mtable mtd mtext mtr munder
62
- munderover none semantics]
63
-
64
- SVG_ELEMENTS = Set.new %w[a animate animateColor animateMotion animateTransform
65
- circle clipPath defs desc ellipse feGaussianBlur filter font-face
66
- font-face-name font-face-src foreignObject
67
- g glyph hkern linearGradient line marker mask metadata missing-glyph
68
- mpath path polygon polyline radialGradient rect set stop svg switch symbol
69
- text textPath title tspan use]
70
-
71
- ACCEPTABLE_ATTRIBUTES = Set.new %w[abbr accept accept-charset accesskey action
72
- align alt axis border cellpadding cellspacing char charoff charset
73
- checked cite class clear cols colspan color compact coords datetime
74
- dir disabled enctype for frame headers height href hreflang hspace id
75
- ismap label lang longdesc loop loopcount loopend loopstart
76
- maxlength media method multiple name nohref
77
- noshade nowrap poster preload prompt readonly rel rev rows rowspan rules scope
78
- selected shape size span src start style summary tabindex target title
79
- type usemap valign value vspace width xml:lang]
80
-
81
- MATHML_ATTRIBUTES = Set.new %w[actiontype align close
82
- columnalign columnlines columnspacing columnspan depth display
83
- displaystyle encoding equalcolumns equalrows fence fontstyle fontweight
84
- frame height linethickness lspace mathbackground mathcolor mathvariant
85
- maxsize minsize open other rowalign rowlines
86
- rowspacing rowspan rspace scriptlevel selection separator separators
87
- stretchy width xlink:href xlink:show xlink:type xmlns xmlns:xlink]
88
-
89
- SVG_ATTRIBUTES = Set.new %w[accent-height accumulate additive alphabetic
90
- arabic-form ascent attributeName attributeType baseProfile bbox begin
91
- by calcMode cap-height class clip-path clip-rule color
92
- color-interpolation-filters color-rendering content cx cy d dx
93
- dy descent display dur end fill fill-opacity fill-rule
94
- filterRes filterUnits font-family
95
- font-size font-stretch font-style font-variant font-weight fx fy g1
96
- g2 glyph-name gradientUnits hanging height horiz-adv-x horiz-origin-x id
97
- ideographic k keyPoints keySplines keyTimes lang marker-end
98
- marker-mid marker-start markerHeight markerUnits markerWidth
99
- maskContentUnits maskUnits mathematical max method min name offset opacity orient origin
100
- overline-position overline-thickness panose-1 path pathLength
101
- patternContentUnits patternTransform patternUnits points
102
- preserveAspectRatio primitiveUnits r refX refY repeatCount repeatDur
103
- requiredExtensions requiredFeatures restart rotate rx ry slope spacing
104
- startOffset stdDeviation stemh
105
- stemv stop-color stop-opacity strikethrough-position
106
- strikethrough-thickness stroke stroke-dasharray stroke-dashoffset
107
- stroke-linecap stroke-linejoin stroke-miterlimit stroke-opacity
108
- stroke-width systemLanguage target text-anchor to transform type u1
109
- u2 underline-position underline-thickness unicode unicode-range
110
- units-per-em values version viewBox visibility width widths x
111
- x-height x1 x2 xlink:actuate xlink:arcrole xlink:href xlink:role
112
- xlink:show xlink:title xlink:type xml:base xml:lang xml:space xmlns
113
- xmlns:xlink y y1 y2 zoomAndPan]
114
-
115
- ATTR_VAL_IS_URI = Set.new %w[href src cite action longdesc xlink:href xml:base poster preload]
116
-
117
- SVG_ATTR_VAL_ALLOWS_REF = Set.new %w[clip-path color-profile cursor fill
118
- filter marker marker-start marker-mid marker-end mask stroke]
119
-
120
- SVG_ALLOW_LOCAL_HREF = Set.new %w[altGlyph animate animateColor animateMotion
121
- animateTransform cursor feImage filter linearGradient pattern
122
- radialGradient textpath tref set use]
123
-
124
- ACCEPTABLE_CSS_PROPERTIES = Set.new %w[azimuth background-color
125
- border-bottom-color border-collapse border-color border-left-color
126
- border-right-color border-top-color clear color cursor direction
127
- display elevation float font font-family font-size font-style
128
- font-variant font-weight height letter-spacing line-height list-style-type
129
- overflow pause pause-after pause-before pitch pitch-range richness speak
130
- speak-header speak-numeral speak-punctuation speech-rate stress
131
- text-align text-decoration text-indent unicode-bidi vertical-align
132
- voice-family volume white-space width]
133
-
134
- ACCEPTABLE_CSS_KEYWORDS = Set.new %w[auto aqua black block blue bold both bottom
135
- brown center collapse dashed dotted fuchsia gray green !important
136
- italic left lime maroon medium none navy normal nowrap olive pointer
137
- purple red right solid silver teal top transparent underline white
138
- yellow]
139
-
140
- ACCEPTABLE_CSS_FUNCTIONS = Set.new %w[calc rgb]
141
-
142
- SHORTHAND_CSS_PROPERTIES = Set.new %w[background border margin padding]
143
-
144
- ACCEPTABLE_SVG_PROPERTIES = Set.new %w[fill fill-opacity fill-rule stroke
145
- stroke-width stroke-linecap stroke-linejoin stroke-opacity]
146
-
147
- PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/i
148
-
149
- ACCEPTABLE_PROTOCOLS = Set.new %w[ed2k ftp http https irc mailto news gopher nntp
150
- telnet webcal xmpp callto feed urn aim rsync tag ssh sftp rtsp afs data]
151
-
152
- ACCEPTABLE_URI_DATA_MEDIATYPES = Set.new %w[text/plain text/css image/png image/gif
153
- image/jpeg image/svg+xml]
154
-
155
- # subclasses may define their own versions of these constants
156
- ALLOWED_ELEMENTS = ACCEPTABLE_ELEMENTS + MATHML_ELEMENTS + SVG_ELEMENTS
157
- ALLOWED_ATTRIBUTES = ACCEPTABLE_ATTRIBUTES + MATHML_ATTRIBUTES + SVG_ATTRIBUTES
158
- ALLOWED_CSS_PROPERTIES = ACCEPTABLE_CSS_PROPERTIES
159
- ALLOWED_CSS_KEYWORDS = ACCEPTABLE_CSS_KEYWORDS
160
- ALLOWED_CSS_FUNCTIONS = ACCEPTABLE_CSS_FUNCTIONS
161
- ALLOWED_SVG_PROPERTIES = ACCEPTABLE_SVG_PROPERTIES
162
- ALLOWED_PROTOCOLS = ACCEPTABLE_PROTOCOLS
163
- ALLOWED_URI_DATA_MEDIATYPES = ACCEPTABLE_URI_DATA_MEDIATYPES
164
-
165
- VOID_ELEMENTS = Set.new %w[
166
- base
167
- link
168
- meta
169
- hr
170
- br
171
- img
172
- embed
173
- param
174
- area
175
- col
176
- input
177
- ]
178
-
179
- # additional tags we should consider safe since we have libxml2 fixing up our documents.
180
- TAGS_SAFE_WITH_LIBXML2 = Set.new %w[html head body]
181
- ALLOWED_ELEMENTS_WITH_LIBXML2 = ALLOWED_ELEMENTS + TAGS_SAFE_WITH_LIBXML2
182
- end
183
-
184
- ::Loofah::MetaHelpers.add_downcased_set_members_to_all_set_constants ::Loofah::HTML5::WhiteList
185
- end
186
- end
@@ -1,63 +0,0 @@
1
- <meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="ProgId" content="Word.Document"><meta name="Generator" content="Microsoft Word 11"><meta name="Originator" content="Microsoft Word 11"><link rel="File-List" href="file:///C:%5CDOCUME%7E1%5CNICOLE%7E1%5CLOCALS%7E1%5CTemp%5Cmsohtml1%5C01%5Cclip_filelist.xml"><!--[if gte mso 9]><xml>
2
- <w:WordDocument>
3
- <w:View>Normal</w:View>
4
- <w:Zoom>0</w:Zoom>
5
- <w:PunctuationKerning/>
6
- <w:ValidateAgainstSchemas/>
7
- <w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid>
8
- <w:IgnoreMixedContent>false</w:IgnoreMixedContent>
9
- <w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText>
10
- <w:Compatibility>
11
- <w:BreakWrappedTables/>
12
- <w:SnapToGridInCell/>
13
- <w:WrapTextWithPunct/>
14
- <w:UseAsianBreakRules/>
15
- <w:DontGrowAutofit/>
16
- </w:Compatibility>
17
- <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
18
- </w:WordDocument>
19
- </xml><![endif]--><!--[if gte mso 9]><xml>
20
- <w:LatentStyles DefLockedState="false" LatentStyleCount="156">
21
- </w:LatentStyles>
22
- </xml><![endif]--><style>
23
- <!--
24
- /* Style Definitions */
25
- p.MsoNormal, li.MsoNormal, div.MsoNormal
26
- {mso-style-parent:"";
27
- margin:0in;
28
- margin-bottom:.0001pt;
29
- mso-pagination:widow-orphan;
30
- font-size:12.0pt;
31
- font-family:"Times New Roman";
32
- mso-fareast-font-family:"Times New Roman";}
33
- @page Section1
34
- {size:8.5in 11.0in;
35
- margin:1.0in 1.25in 1.0in 1.25in;
36
- mso-header-margin:.5in;
37
- mso-footer-margin:.5in;
38
- mso-paper-source:0;}
39
- div.Section1
40
- {page:Section1;}
41
- -->
42
- </style><!--[if gte mso 10]>
43
- <style>
44
- /* Style Definitions */
45
- table.MsoNormalTable
46
- {mso-style-name:"Table Normal";
47
- mso-tstyle-rowband-size:0;
48
- mso-tstyle-colband-size:0;
49
- mso-style-noshow:yes;
50
- mso-style-parent:"";
51
- mso-padding-alt:0in 5.4pt 0in 5.4pt;
52
- mso-para-margin:0in;
53
- mso-para-margin-bottom:.0001pt;
54
- mso-pagination:widow-orphan;
55
- font-size:10.0pt;
56
- font-family:"Times New Roman";
57
- mso-ansi-language:#0400;
58
- mso-fareast-language:#0400;
59
- mso-bidi-language:#0400;}
60
- </style>
61
- <![endif]-->
62
-
63
- <p class="MsoNormal">Foo <b style="">BOLD<o:p></o:p></b></p>
@@ -1,502 +0,0 @@
1
- [
2
- {
3
- "name": "IE_Comments",
4
- "input": "<!--[if gte IE 4]><script>alert('XSS');</script><![endif]-->",
5
- "output": "&lt;!--[if gte IE 4]&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;&lt;![endif]--&gt;"
6
- },
7
-
8
- {
9
- "name": "IE_Comments_2",
10
- "input": "<![if !IE 5]><script>alert('XSS');</script><![endif]>",
11
- "output": "&lt;script&gt;alert('XSS');&lt;/script&gt;",
12
- "rexml": "Ill-formed XHTML!"
13
- },
14
-
15
- {
16
- "name": "allow_colons_in_path_component",
17
- "input": "<a href=\"./this:that\">foo</a>",
18
- "output": "<a href='./this:that'>foo</a>"
19
- },
20
-
21
- {
22
- "name": "background_attribute",
23
- "input": "<div background=\"javascript:alert('XSS')\"></div>",
24
- "output": "<div/>",
25
- "xhtml": "<div></div>",
26
- "rexml": "<div></div>"
27
- },
28
-
29
- {
30
- "name": "bgsound",
31
- "input": "<bgsound src=\"javascript:alert('XSS');\" />",
32
- "output": "&lt;bgsound src=\"javascript:alert('XSS');\"/&gt;",
33
- "rexml": "&lt;bgsound src=\"javascript:alert('XSS');\"&gt;&lt;/bgsound&gt;"
34
- },
35
-
36
- {
37
- "name": "div_background_image_unicode_encoded",
38
- "input": "<div style=\"background-image:\u00a5\u00a2\u006C\u0028'\u006a\u0061\u00a6\u0061\u00a3\u0063\u00a2\u0069\u00a0\u00a4\u003a\u0061\u006c\u0065\u00a2\u00a4\u0028.1027\u0058.1053\u0053\u0027\u0029'\u0029\">foo</div>",
39
- "output": "<div>foo</div>"
40
- },
41
-
42
- {
43
- "name": "div_expression",
44
- "input": "<div style=\"width: expression(alert('XSS'));\">foo</div>",
45
- "output": "<div>foo</div>"
46
- },
47
-
48
- {
49
- "name": "double_open_angle_brackets",
50
- "input": "<img src=http://ha.ckers.org/scriptlet.html <",
51
- "output": "<img src='http://ha.ckers.org/scriptlet.html'>",
52
- "rexml": "Ill-formed XHTML!"
53
- },
54
-
55
- {
56
- "name": "double_open_angle_brackets_2",
57
- "input": "<script src=http://ha.ckers.org/scriptlet.html <",
58
- "output": "&lt;script src=\"http://ha.ckers.org/scriptlet.html\"&gt;&lt;/script&gt;",
59
- "rexml": "Ill-formed XHTML!"
60
- },
61
-
62
- {
63
- "name": "grave_accents",
64
- "input": "<img src=`javascript:alert('XSS')` />",
65
- "output": "<img>",
66
- "rexml": "Ill-formed XHTML!"
67
- },
68
-
69
- {
70
- "name": "img_dynsrc_lowsrc",
71
- "input": "<img dynsrc=\"javascript:alert('XSS')\" />",
72
- "output": "<img>",
73
- "rexml": "<img />"
74
- },
75
-
76
- {
77
- "name": "img_vbscript",
78
- "input": "<img src='vbscript:msgbox(\"XSS\")' />",
79
- "output": "<img>",
80
- "rexml": "<img />"
81
- },
82
-
83
- {
84
- "name": "input_image",
85
- "input": "<input type=\"image\" src=\"javascript:alert('XSS');\" />",
86
- "output": "<input type='image'>",
87
- "rexml": "<input type='image' />"
88
- },
89
-
90
- {
91
- "name": "link_stylesheets",
92
- "input": "<link rel=\"stylesheet\" href=\"javascript:alert('XSS');\" />",
93
- "output": "&lt;link rel=\"stylesheet\" href=\"javascript:alert('XSS');\"&gt;",
94
- "rexml": "&lt;link href=\"javascript:alert('XSS');\" rel=\"stylesheet\"/&gt;"
95
- },
96
-
97
- {
98
- "name": "link_stylesheets_2",
99
- "input": "<link rel=\"stylesheet\" href=\"http://ha.ckers.org/xss.css\" />",
100
- "output": "&lt;link rel=\"stylesheet\" href=\"http://ha.ckers.org/xss.css\"&gt;",
101
- "rexml": "&lt;link href=\"http://ha.ckers.org/xss.css\" rel=\"stylesheet\"/&gt;"
102
- },
103
-
104
- {
105
- "name": "list_style_image",
106
- "input": "<li style=\"list-style-image: url(javascript:alert('XSS'))\">foo</li>",
107
- "output": "<li>foo</li>"
108
- },
109
-
110
- {
111
- "name": "no_closing_script_tags",
112
- "input": "<script src=http://ha.ckers.org/xss.js?<b>",
113
- "output": "&lt;script src=\"http://ha.ckers.org/xss.js?&amp;lt;b\"&gt;&lt;/script&gt;",
114
- "rexml": "Ill-formed XHTML!"
115
- },
116
-
117
- {
118
- "name": "non_alpha_non_digit",
119
- "input": "<script/XSS src=\"http://ha.ckers.org/xss.js\"></script>",
120
- "output": "&lt;script src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;",
121
- "rexml": "Ill-formed XHTML!"
122
- },
123
-
124
- {
125
- "name": "non_alpha_non_digit_2",
126
- "input": "<a onclick!\\#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>foo</a>",
127
- "output": "<a>foo</a>",
128
- "rexml": "Ill-formed XHTML!"
129
- },
130
-
131
- {
132
- "name": "non_alpha_non_digit_3",
133
- "input": "<img/src=\"http://ha.ckers.org/xss.js\"/>",
134
- "output": "<img>",
135
- "rexml": "Ill-formed XHTML!"
136
- },
137
-
138
- {
139
- "name": "non_alpha_non_digit_II",
140
- "input": "<a href!\\#$%&()*~+-_.,:;?@[/|]^`=alert('XSS')>foo</a>",
141
- "output": "<a>foo</a>",
142
- "rexml": "Ill-formed XHTML!"
143
- },
144
-
145
- {
146
- "name": "non_alpha_non_digit_III",
147
- "input": "<a/href=\"javascript:alert('XSS');\">foo</a>",
148
- "output": "<a>foo</a>",
149
- "rexml": "Ill-formed XHTML!"
150
- },
151
-
152
- {
153
- "name": "platypus",
154
- "input": "<a href=\"http://www.ragingplatypus.com/\" style=\"display:block; position:absolute; left:0; top:0; width:100%; height:100%; z-index:1; background-color:black; background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg); background-x:center; background-y:center; background-repeat:repeat;\">never trust your upstream platypus</a>",
155
- "output": "<a href='http://www.ragingplatypus.com/' style='display:block;width:100%;height:100%;background-color:black;background-x:center;background-y:center;'>never trust your upstream platypus</a>"
156
- },
157
-
158
- {
159
- "name": "protocol_resolution_in_script_tag",
160
- "input": "<script src=//ha.ckers.org/.j></script>",
161
- "output": "&lt;script src=\"//ha.ckers.org/.j\"&gt;&lt;/script&gt;",
162
- "rexml": "Ill-formed XHTML!"
163
- },
164
-
165
- {
166
- "name": "should_allow_anchors",
167
- "input": "<a href='foo' onclick='bar'><script>baz</script></a>",
168
- "output": "<a href='foo'>&lt;script&gt;baz&lt;/script&gt;</a>"
169
- },
170
-
171
- {
172
- "name": "should_allow_image_alt_attribute",
173
- "input": "<img alt='foo' onclick='bar' />",
174
- "output": "<img alt='foo'>",
175
- "rexml": "<img alt='foo' />"
176
- },
177
-
178
- {
179
- "name": "should_allow_image_height_attribute",
180
- "input": "<img height='foo' onclick='bar' />",
181
- "output": "<img height='foo'>",
182
- "rexml": "<img height='foo' />"
183
- },
184
-
185
- {
186
- "name": "should_allow_image_src_attribute",
187
- "input": "<img src='foo' onclick='bar' />",
188
- "output": "<img src='foo'>",
189
- "rexml": "<img src='foo' />"
190
- },
191
-
192
- {
193
- "name": "should_allow_image_width_attribute",
194
- "input": "<img width='foo' onclick='bar' />",
195
- "output": "<img width='foo'>",
196
- "rexml": "<img width='foo' />"
197
- },
198
-
199
- {
200
- "name": "should_handle_blank_text",
201
- "input": "",
202
- "output": ""
203
- },
204
-
205
- {
206
- "name": "should_handle_malformed_image_tags",
207
- "input": "<img \"\"\"><script>alert(\"XSS\")</script>\">",
208
- "output": "<img>&lt;script&gt;alert(\"XSS\")&lt;/script&gt;\"&gt;",
209
- "rexml": "Ill-formed XHTML!"
210
- },
211
-
212
- {
213
- "name": "should_handle_non_html",
214
- "input": "abc",
215
- "output": "abc"
216
- },
217
-
218
- {
219
- "name": "should_not_fall_for_ridiculous_hack",
220
- "input": "<img\nsrc\n=\n\"\nj\na\nv\na\ns\nc\nr\ni\np\nt\n:\na\nl\ne\nr\nt\n(\n'\nX\nS\nS\n'\n)\n\"\n />",
221
- "output": "<img>",
222
- "rexml": "<img />"
223
- },
224
-
225
- {
226
- "name": "should_not_fall_for_xss_image_hack_0",
227
- "input": "<img src=\"javascript:alert('XSS');\" />",
228
- "output": "<img>",
229
- "rexml": "<img />"
230
- },
231
-
232
- {
233
- "name": "should_not_fall_for_xss_image_hack_1",
234
- "input": "<img src=javascript:alert('XSS') />",
235
- "output": "<img>",
236
- "rexml": "Ill-formed XHTML!"
237
- },
238
-
239
- {
240
- "name": "should_not_fall_for_xss_image_hack_10",
241
- "input": "<img src=\"jav&#x0A;ascript:alert('XSS');\" />",
242
- "output": "<img>",
243
- "rexml": "<img />"
244
- },
245
-
246
- {
247
- "name": "should_not_fall_for_xss_image_hack_11",
248
- "input": "<img src=\"jav&#x0D;ascript:alert('XSS');\" />",
249
- "output": "<img>",
250
- "rexml": "<img />"
251
- },
252
-
253
- {
254
- "name": "should_not_fall_for_xss_image_hack_12",
255
- "input": "<img src=\" &#14; javascript:alert('XSS');\" />",
256
- "output": "<img>",
257
- "rexml": "<img />"
258
- },
259
-
260
- {
261
- "name": "should_not_fall_for_xss_image_hack_13",
262
- "input": "<img src=\"&#x20;javascript:alert('XSS');\" />",
263
- "output": "<img>",
264
- "rexml": "<img />"
265
- },
266
-
267
- {
268
- "name": "should_not_fall_for_xss_image_hack_14",
269
- "input": "<img src=\"&#xA0;javascript:alert('XSS');\" />",
270
- "output": "<img>",
271
- "rexml": "<img />"
272
- },
273
-
274
- {
275
- "name": "should_not_fall_for_xss_image_hack_2",
276
- "input": "<img src=\"JaVaScRiPt:alert('XSS')\" />",
277
- "output": "<img>",
278
- "rexml": "<img />"
279
- },
280
-
281
- {
282
- "name": "should_not_fall_for_xss_image_hack_3",
283
- "input": "<img src='javascript:alert(&quot;XSS&quot;)' />",
284
- "output": "<img>",
285
- "rexml": "<img />"
286
- },
287
-
288
- {
289
- "name": "should_not_fall_for_xss_image_hack_4",
290
- "input": "<img src='javascript:alert(String.fromCharCode(88,83,83))' />",
291
- "output": "<img>",
292
- "rexml": "<img />"
293
- },
294
-
295
- {
296
- "name": "should_not_fall_for_xss_image_hack_5",
297
- "input": "<img src='&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;' />",
298
- "output": "<img>",
299
- "rexml": "<img />"
300
- },
301
-
302
- {
303
- "name": "should_not_fall_for_xss_image_hack_6",
304
- "input": "<img src='&#0000106;&#0000097;&#0000118;&#0000097;&#0000115;&#0000099;&#0000114;&#0000105;&#0000112;&#0000116;&#0000058;&#0000097;&#0000108;&#0000101;&#0000114;&#0000116;&#0000040;&#0000039;&#0000088;&#0000083;&#0000083;&#0000039;&#0000041' />",
305
- "output": "<img>",
306
- "rexml": "<img />"
307
- },
308
-
309
- {
310
- "name": "should_not_fall_for_xss_image_hack_7",
311
- "input": "<img src='&#x6A;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3A;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29' />",
312
- "output": "<img>",
313
- "rexml": "<img />"
314
- },
315
-
316
- {
317
- "name": "should_not_fall_for_xss_image_hack_8",
318
- "input": "<img src=\"jav\tascript:alert('XSS');\" />",
319
- "output": "<img>",
320
- "rexml": "<img />"
321
- },
322
-
323
- {
324
- "name": "should_not_fall_for_xss_image_hack_9",
325
- "input": "<img src=\"jav&#x09;ascript:alert('XSS');\" />",
326
- "output": "<img>",
327
- "rexml": "<img />"
328
- },
329
-
330
- {
331
- "name": "should_sanitize_half_open_scripts",
332
- "input": "<img src=\"javascript:alert('XSS')\"",
333
- "output": "<img>",
334
- "rexml": "Ill-formed XHTML!"
335
- },
336
-
337
- {
338
- "name": "should_sanitize_invalid_script_tag",
339
- "input": "<script/XSS SRC=\"http://ha.ckers.org/xss.js\"></script>",
340
- "output": "&lt;script src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;",
341
- "rexml": "Ill-formed XHTML!"
342
- },
343
-
344
- {
345
- "name": "should_sanitize_script_tag_with_multiple_open_brackets",
346
- "input": "<<script>alert(\"XSS\");//<</script>",
347
- "output": "alert(\"XSS\");//",
348
- "xhtml": "&lt;&lt;script&gt;alert('XSS');//&lt;&lt;/script&gt;",
349
- "rexml": "Ill-formed XHTML!"
350
- },
351
-
352
- {
353
- "name": "should_sanitize_script_tag_with_multiple_open_brackets_2",
354
- "input": "<iframe src=http://ha.ckers.org/scriptlet.html\n<",
355
- "output": "&lt;iframe src=\"http://ha.ckers.org/scriptlet.html\"&gt;&lt;/iframe&gt;",
356
- "rexml": "Ill-formed XHTML!"
357
- },
358
-
359
- {
360
- "name": "should_sanitize_tag_broken_up_by_null",
361
- "input": "<scr\u0000ipt>alert(\"XSS\")</scr\u0000ipt>",
362
- "output": "&lt;scr&gt;&lt;/scr&gt;",
363
- "rexml": "Ill-formed XHTML!"
364
- },
365
-
366
- {
367
- "name": "should_sanitize_unclosed_script",
368
- "input": "<script src=http://ha.ckers.org/xss.js?<b>",
369
- "output": "&lt;script src=\"http://ha.ckers.org/xss.js?&amp;lt;b\"&gt;&lt;/script&gt;",
370
- "rexml": "Ill-formed XHTML!"
371
- },
372
-
373
- {
374
- "name": "should_strip_href_attribute_in_a_with_bad_protocols",
375
- "input": "<a href=\"javascript:XSS\" title=\"1\">boo</a>",
376
- "output": "<a title='1'>boo</a>"
377
- },
378
-
379
- {
380
- "name": "should_strip_href_attribute_in_a_with_bad_protocols_and_whitespace",
381
- "input": "<a href=\" javascript:XSS\" title=\"1\">boo</a>",
382
- "output": "<a title='1'>boo</a>"
383
- },
384
-
385
- {
386
- "name": "should_strip_src_attribute_in_img_with_bad_protocols",
387
- "input": "<img src=\"javascript:XSS\" title=\"1\">boo</img>",
388
- "output": "<img title='1'>boo",
389
- "rexml": "<img title='1' />"
390
- },
391
-
392
- {
393
- "name": "should_strip_src_attribute_in_img_with_bad_protocols_and_whitespace",
394
- "input": "<img src=\" javascript:XSS\" title=\"1\">boo</img>",
395
- "output": "<img title='1'>boo",
396
- "rexml": "<img title='1' />"
397
- },
398
-
399
- {
400
- "name": "xml_base",
401
- "input": "<div xml:base=\"javascript:alert('XSS');//\">foo</div>",
402
- "output": "<div>foo</div>"
403
- },
404
-
405
- {
406
- "name": "xul",
407
- "input": "<p style=\"-moz-binding:url('http://ha.ckers.org/xssmoz.xml#xss')\">fubar</p>",
408
- "output": "<p>fubar</p>"
409
- },
410
-
411
- {
412
- "name": "quotes_in_attributes",
413
- "input": "<img src='foo' title='\"foo\" bar' />",
414
- "rexml": "<img src='foo' title='\"foo\" bar' />",
415
- "output": "<img src='foo' title='\"foo\" bar'>"
416
- },
417
-
418
- {
419
- "name": "uri_refs_in_svg_attributes",
420
- "input": "<rect fill='url(#foo)' />",
421
- "rexml": "<rect fill='url(#foo)'></rect>",
422
- "xhtml": "<rect fill='url(#foo)'></rect>",
423
- "output": "<rect fill='url(#foo)'/>"
424
- },
425
-
426
- {
427
- "name": "absolute_uri_refs_in_svg_attributes",
428
- "input": "<rect fill='url(http://bad.com/) #fff' />",
429
- "rexml": "<rect fill=' #fff'></rect>",
430
- "xhtml": "<rect fill=' #fff'></rect>",
431
- "output": "<rect fill=' #fff'/>"
432
- },
433
-
434
- {
435
- "name": "uri_ref_with_space_in svg_attribute",
436
- "input": "<rect fill='url(\n#foo)' />",
437
- "rexml": "<rect fill='url(\n#foo)'></rect>",
438
- "xhtml": "<rect fill='url(\n#foo)'></rect>",
439
- "output": "<rect fill='url(\n#foo)'/>"
440
- },
441
-
442
- {
443
- "name": "absolute_uri_ref_with_space_in svg_attribute",
444
- "input": "<rect fill=\"url(\nhttp://bad.com/)\" />",
445
- "rexml": "<rect></rect>",
446
- "xhtml": "<rect></rect>",
447
- "output": "<rect/>"
448
- },
449
-
450
- {
451
- "name": "allow_html5_image_tag",
452
- "input": "<image src='foo' />",
453
- "rexml": "&lt;image src=\"foo\"&gt;&lt;/image&gt;",
454
- "output": "&lt;image src=\"foo\"/&gt;"
455
- },
456
-
457
- {
458
- "name": "style_attr_end_with_nothing",
459
- "input": "<div style=\"color: blue\" />",
460
- "output": "<div style='color: blue;'/>",
461
- "xhtml": "<div style='color: blue;'></div>",
462
- "rexml": "<div style='color: blue;'></div>"
463
- },
464
-
465
- {
466
- "name": "style_attr_end_with_space",
467
- "input": "<div style=\"color: blue \" />",
468
- "output": "<div style='color: blue ;'/>",
469
- "xhtml": "<div style='color: blue ;'></div>",
470
- "rexml": "<div style='color: blue ;'></div>"
471
- },
472
-
473
- {
474
- "name": "style_attr_end_with_semicolon",
475
- "input": "<div style=\"color: blue;\" />",
476
- "output": "<div style='color: blue;'/>",
477
- "xhtml": "<div style='color: blue;'></div>",
478
- "rexml": "<div style='color: blue;'></div>"
479
- },
480
-
481
- {
482
- "name": "style_attr_end_with_semicolon_space",
483
- "input": "<div style=\"color: blue; \" />",
484
- "output": "<div style='color: blue;'/>",
485
- "xhtml": "<div style='color: blue;'></div>",
486
- "rexml": "<div style='color: blue;'></div>"
487
- },
488
-
489
- {
490
- "name": "attributes_with_embedded_quotes",
491
- "input": "<img src=doesntexist.jpg\"'onerror=\"alert(1) />",
492
- "output": "<img src='doesntexist.jpg%22'onerror=%22alert(1)'>",
493
- "rexml": "Ill-formed XHTML!"
494
- },
495
-
496
- {
497
- "name": "attributes_with_embedded_quotes_II",
498
- "input": "<img src=notthere.jpg\"\"onerror=\"alert(2) />",
499
- "output": "<img src='notthere.jpg%22%22onerror=%22alert(2)'>",
500
- "rexml": "Ill-formed XHTML!"
501
- }
502
- ]