URISchemeTest.php 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194
  1. <?php
  2. // WARNING: All the URI schemes are far to relaxed, we need to tighten
  3. // the checks.
  4. class HTMLPurifier_URISchemeTest extends HTMLPurifier_URIHarness
  5. {
  6. private $pngBase64;
  7. public function __construct() {
  8. $this->pngBase64 =
  9. 'iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAABGdBTUEAALGP'.
  10. 'C/xhBQAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9YGARc5KB0XV+IA'.
  11. 'AAAddEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIFRoZSBHSU1Q72QlbgAAAF1J'.
  12. 'REFUGNO9zL0NglAAxPEfdLTs4BZM4DIO4C7OwQg2JoQ9LE1exdlYvBBeZ7jq'.
  13. 'ch9//q1uH4TLzw4d6+ErXMMcXuHWxId3KOETnnXXV6MJpcq2MLaI97CER3N0'.
  14. 'vr4MkhoXe0rZigAAAABJRU5ErkJggg==';
  15. }
  16. protected function assertValidation($uri, $expect_uri = true) {
  17. $this->prepareURI($uri, $expect_uri);
  18. $this->config->set('URI.AllowedSchemes', array($uri->scheme));
  19. // convenience hack: the scheme should be explicitly specified
  20. $scheme = $uri->getSchemeObj($this->config, $this->context);
  21. $result = $scheme->validate($uri, $this->config, $this->context);
  22. $this->assertEitherFailOrIdentical($result, $uri, $expect_uri);
  23. }
  24. function test_http_regular() {
  25. $this->assertValidation(
  26. 'http://example.com/?s=q#fragment'
  27. );
  28. }
  29. function test_http_uppercase() {
  30. $this->assertValidation(
  31. 'http://example.com/FOO'
  32. );
  33. }
  34. function test_http_removeDefaultPort() {
  35. $this->assertValidation(
  36. 'http://example.com:80',
  37. 'http://example.com'
  38. );
  39. }
  40. function test_http_removeUserInfo() {
  41. $this->assertValidation(
  42. 'http://bob@example.com',
  43. 'http://example.com'
  44. );
  45. }
  46. function test_http_preserveNonDefaultPort() {
  47. $this->assertValidation(
  48. 'http://example.com:8080'
  49. );
  50. }
  51. function test_https_regular() {
  52. $this->assertValidation(
  53. 'https://user@example.com:443/?s=q#frag',
  54. 'https://example.com/?s=q#frag'
  55. );
  56. }
  57. function test_ftp_regular() {
  58. $this->assertValidation(
  59. 'ftp://user@example.com/path'
  60. );
  61. }
  62. function test_ftp_removeDefaultPort() {
  63. $this->assertValidation(
  64. 'ftp://example.com:21',
  65. 'ftp://example.com'
  66. );
  67. }
  68. function test_ftp_removeQueryString() {
  69. $this->assertValidation(
  70. 'ftp://example.com?s=q',
  71. 'ftp://example.com'
  72. );
  73. }
  74. function test_ftp_preserveValidTypecode() {
  75. $this->assertValidation(
  76. 'ftp://example.com/file.txt;type=a'
  77. );
  78. }
  79. function test_ftp_removeInvalidTypecode() {
  80. $this->assertValidation(
  81. 'ftp://example.com/file.txt;type=z',
  82. 'ftp://example.com/file.txt'
  83. );
  84. }
  85. function test_ftp_encodeExtraSemicolons() {
  86. $this->assertValidation(
  87. 'ftp://example.com/too;many;semicolons=1',
  88. 'ftp://example.com/too%3Bmany%3Bsemicolons=1'
  89. );
  90. }
  91. function test_news_regular() {
  92. $this->assertValidation(
  93. 'news:gmane.science.linguistics'
  94. );
  95. }
  96. function test_news_explicit() {
  97. $this->assertValidation(
  98. 'news:642@eagle.ATT.COM'
  99. );
  100. }
  101. function test_news_removeNonPathComponents() {
  102. $this->assertValidation(
  103. 'news://user@example.com:80/rec.music?path=foo#frag',
  104. 'news:/rec.music#frag'
  105. );
  106. }
  107. function test_nntp_regular() {
  108. $this->assertValidation(
  109. 'nntp://news.example.com/alt.misc/42#frag'
  110. );
  111. }
  112. function test_nntp_removalOfRedundantOrUselessComponents() {
  113. $this->assertValidation(
  114. 'nntp://user@news.example.com:119/alt.misc/42?s=q#frag',
  115. 'nntp://news.example.com/alt.misc/42#frag'
  116. );
  117. }
  118. function test_mailto_regular() {
  119. $this->assertValidation(
  120. 'mailto:bob@example.com'
  121. );
  122. }
  123. function test_mailto_removalOfRedundantOrUselessComponents() {
  124. $this->assertValidation(
  125. 'mailto://user@example.com:80/bob@example.com?subject=Foo#frag',
  126. 'mailto:/bob@example.com?subject=Foo#frag'
  127. );
  128. }
  129. function test_data_png() {
  130. $this->assertValidation(
  131. 'data:image/png;base64,'.$this->pngBase64
  132. );
  133. }
  134. function test_data_malformed() {
  135. $this->assertValidation(
  136. 'data:image/png;base64,vr4MkhoXJRU5ErkJggg==',
  137. false
  138. );
  139. }
  140. function test_data_implicit() {
  141. $this->assertValidation(
  142. 'data:base64,'.$this->pngBase64,
  143. 'data:image/png;base64,'.$this->pngBase64
  144. );
  145. }
  146. function test_file_basic() {
  147. $this->assertValidation(
  148. 'file://user@MYCOMPUTER:12/foo/bar?baz#frag',
  149. 'file://MYCOMPUTER/foo/bar#frag'
  150. );
  151. }
  152. function test_file_local() {
  153. $this->assertValidation(
  154. 'file:///foo/bar?baz#frag',
  155. 'file:///foo/bar#frag'
  156. );
  157. }
  158. function test_ftp_empty_host() {
  159. $this->assertValidation('ftp:///example.com', false);
  160. }
  161. }
  162. // vim: et sw=4 sts=4