1 files changed, 82 insertions, 0 deletions
diff --git a/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html b/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html
new file mode 100644
index 0000000000..6e0a827cd9
--- /dev/null
+++ b/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html
@@ -0,0 +1,82 @@
+<!DOCTYPE HTML>
+<title>Test sanitizer api</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css" />
+<div id="div"></div>
+<script type="text/javascript">
+"use strict";
+/* global Sanitizer */
+// we're not done after "onload"
+SimpleTest.waitForExplicitFinish();
+(async function() {
+  // Ensure Sanitizer is not exposed when the pref is false
+  await SpecialPowers.pushPrefEnv({
+    set: [["dom.security.sanitizer.enabled", false]],
+  });
+  ok(typeof Sanitizer === "undefined", "Sanitizer undefined when preffed off");
+
+  // The rest of this test assumes the sanitizer is enabled
+  await SpecialPowers.pushPrefEnv({
+    set: [["dom.security.sanitizer.enabled", true]],
+  });
+
+
+  function* possibleInputTypes(inputStr) {
+    /* This generator function, given a string, yields all possible input objects
+    for our sanitizer API (string, docfragment, document).
+    */
+
+    // 1) as string
+    yield ({testInput: inputStr, testType: "String" });
+    // 2) as DocumentFragment
+    let temp = document.createElement('template');
+    // asking eslint to skip this: innerHTML is safe for template elements.
+    // eslint-disable-next-line no-unsanitized/property
+    temp.innerHTML = inputStr;
+    yield ({testInput: temp.content, testType: "DocumentFragment" });
+    // 3) as HTMLDocument
+    const parser = new DOMParser;
+    yield ({testInput: parser.parseFromString(inputStr, "text/html"), testType: "Document" });
+  }
+  // basic interface smoke test
+  ok(typeof Sanitizer === "function", "Sanitizer constructor exposed when preffed on");
+  const mySanitizer = new Sanitizer();
+  ok(mySanitizer, "Sanitizer constructor works");
+  ok(mySanitizer.sanitize, "sanitize function exists");
+
+  // testing sanitizer results
+  const testCases = [
+    {
+      testString: "<p>hello</p>",
+      testExpected: "<p>hello</p>"
+    },
+    {
+      // script element encoded to not confuse the HTML parser and end execution here
+      testString: "<p>second test</p><script>alert(1)\x3C/script>",
+      testExpected: "<p>second test</p>"
+    },
+  ];
+
+
+  const div = document.getElementById("div");
+  for (let test of testCases) {
+    const {testString, testExpected} = test;
+
+    for (let testInputAndType of possibleInputTypes(testString)) {
+      const {testInput, testType} = testInputAndType;
+
+      // test documentfragment API
+      div.innerHTML = "";
+      const docFragment = mySanitizer.sanitize(testInput);
+      div.append(docFragment);
+      is(div.innerHTML, testExpected, `Sanitizer.sanitize() should turn (${testType}) '${testInput}' into '${testExpected}'`);
+
+      // test string api, doesnt work yet
+      /*is(mySanitizer.sanitizeToString(testInput), testExpected,
+      `Sanitizer.sanitizeToString() should turn (${testType}) '${testInput}' into '${testExpected}'`);*/
+    }
+  }
+
+  SimpleTest.finish();
+})();
+</script>