diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
| commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
| tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /dom/security/sanitizer/tests/mochitest | |
| parent | Initial commit. (diff) | |
| download | firefox-esr-upstream.tar.xz firefox-esr-upstream.zip | |
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
| -rw-r--r-- | dom/security/sanitizer/tests/mochitest/mochitest.ini | 6 | ||||
| -rw-r--r-- | dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html | 139 |
2 files changed, 145 insertions, 0 deletions
diff --git a/dom/security/sanitizer/tests/mochitest/mochitest.ini b/dom/security/sanitizer/tests/mochitest/mochitest.ini new file mode 100644 index 0000000000..2388e0bd12 --- /dev/null +++ b/dom/security/sanitizer/tests/mochitest/mochitest.ini @@ -0,0 +1,6 @@ +[DEFAULT] +prefs = + dom.security.sanitizer.enabled=true + dom.security.setHTML.enabled=true +scheme=https +[test_sanitizer_api.html] diff --git a/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html b/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html new file mode 100644 index 0000000000..efe8ae73bf --- /dev/null +++ b/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html @@ -0,0 +1,139 @@ +<!DOCTYPE HTML> +<title>Test sanitizer api</title> +<script src="/tests/SimpleTest/SimpleTest.js"></script> +<link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +<script type="text/javascript"> +"use strict"; +/* global Sanitizer */ +// we're not done after "onload" +SimpleTest.waitForExplicitFinish(); +(async function() { + // Ensure Sanitizer is not exposed when the pref is false + const isEnabled = SpecialPowers.getBoolPref("dom.security.sanitizer.enabled"); + if (!isEnabled) { + ok(false, "This test should only be run with dom.security.sanitizer.enabled set to true"); + SimpleTest.finish(); + } + + function* possibleInputTypes(inputStr) { + /* This generator function, given a string, yields all possible input objects + for our sanitizer API (string, docfragment, document). + */ + + // 1) as string + yield ({testInput: inputStr, testType: "String" }); + // 2) as DocumentFragment + let temp = document.createElement('template'); + // asking eslint to skip this: innerHTML is safe for template elements. + // eslint-disable-next-line no-unsanitized/property + temp.innerHTML = inputStr; + yield ({testInput: temp.content, testType: "DocumentFragment" }); + // 3) as HTMLDocument + const parser = new DOMParser; + yield ({testInput: parser.parseFromString(inputStr, "text/html"), testType: "Document" }); + } + // basic interface smoke test + ok(typeof Sanitizer === "function", "Sanitizer constructor exposed when preffed on"); + const mySanitizer = new Sanitizer(); + ok(mySanitizer, "Sanitizer constructor works"); + ok(mySanitizer.sanitize, "sanitize function exists"); + ok("setHTML" in Element.prototype, "Element.setHTML exists"); + + // testing sanitizer results + const testCases = [ + { + testString: "<p>hello</p>", + testExpected: "<p>hello</p>", + sanitizerOptions: {} + }, + { + // script element encoded to not confuse the HTML parser and end execution here + testString: "<p>second test</p><script>alert(1)\x3C/script>", + testExpected: "<p>second test</p>", + sanitizerOptions: {}, + }, + { + // test for the allowElements option + testString: "<p>hello <i>folks</i></p>", + testExpected: "<p>hello folks</p>", + sanitizerOptions: { allowElements: ["p"] }, + }, + { + // test for the blockElements option + testString: "<p>hello <i>folks</i></p>", + testExpected: "<p>hello folks</p>", + sanitizerOptions: { blockElements: ["i"] }, + }, + // TODO: Unknown attributes aren't supported yet. + // { + // // test for the allowAttributes option + // testString: `<p haha="lol">hello</p>`, + // testExpected: `<p haha="lol">hello</p>`, + // sanitizerOptions: { allowUnknownMarkup: true, allowAttributes: { 'haha': ['p'] } }, + // }, + { + // confirming the inverse + testString: `<p haha="lol">hello</p>`, + testExpected: `<p>hello</p>`, + sanitizerOptions: {}, + }, + { + // test for the dropAttributes option + testString: `<p title="dropme">hello</p>`, + testExpected: `<p>hello</p>`, + sanitizerOptions: { dropAttributes: [{name: 'title', elements: ['p']}] }, + }, + { + // confirming the inverse + testString: `<p title="dontdropme">hello</p>`, + testExpected: `<p title="dontdropme">hello</p>`, + sanitizerOptions: {}, + }, + { + // if an attribute is allowed and dropped, the drop will take preference + testString: `<p title="lol">hello</p>`, + testExpected: `<p>hello</p>`, + sanitizerOptions: { + allowAttributes: [{ name: 'title', elements: ['p'] }], + dropAttributes: [{ name: 'title', elements: ['p'] }] + }, + }, + ]; + + + const div = document.createElement("div"); + for (let test of testCases) { + const {testString, testExpected, sanitizerOptions} = test; + const testSanitizer = new Sanitizer(sanitizerOptions); + + for (let testInputAndType of possibleInputTypes(testString)) { + const {testInput, testType} = testInputAndType; + + if (testType != "String") { + // test sanitize(document/fragment) + try { + div.innerHTML = ""; + const docFragment = testSanitizer.sanitize(testInput); + div.append(docFragment); + is(div.innerHTML, testExpected, `Sanitizer.sanitize() should turn (${testType}) '${testInput}' into '${testExpected}'`); + } + catch (e) { + ok(false, 'Error in sanitize() test: ' + e) + } + } + else { + // test setHTML: + try { + div.setHTML(testString, { sanitizer: testSanitizer }); + is(div.innerHTML, testExpected, `div.setHTML() should turn(${testType}) '${testInput}' into '${testExpected}'`); + } + catch (e) { + ok(false, 'Error in setHTML() test: ' + e) + } + } + } + } + + SimpleTest.finish(); +})(); +</script> |