HTML E-mail

From 207a43712406ca88dcc381385ac6a276cb9417e6 Mon Sep 17 00:00:00 2001 From: James Lemieux Date: Wed, 14 May 2014 16:39:33 -0700 Subject: Sanitize HTML for Android Email and the EML viewer b/14567151 This check-in introduces the sanitizer class and the necessary build changes to compile it. A sibling checkin will actually call it. Change-Id: Ic01e44a5a1c6fcb919880f38a391d8475738886b --- .../mail/utils/AdvancedHtmlSanitizerTest.java | 537 ++++++++++ .../android/mail/utils/BasicHtmlSanitizerTest.java | 1055 ++++++++++++++++++++ 2 files changed, 1592 insertions(+) create mode 100644 tests/src/com/android/mail/utils/AdvancedHtmlSanitizerTest.java create mode 100644 tests/src/com/android/mail/utils/BasicHtmlSanitizerTest.java (limited to 'tests') diff --git a/tests/src/com/android/mail/utils/AdvancedHtmlSanitizerTest.java b/tests/src/com/android/mail/utils/AdvancedHtmlSanitizerTest.java new file mode 100644 index 000000000..578ce4ae8 --- /dev/null +++ b/tests/src/com/android/mail/utils/AdvancedHtmlSanitizerTest.java @@ -0,0 +1,537 @@ +package com.android.mail.utils; + +import android.test.AndroidTestCase; +import android.test.suitebuilder.annotation.SmallTest; + +/** + * These test cases verify the handling of more advanced cross-site scripting attacks. + */ +@SmallTest +public class AdvancedHtmlSanitizerTest extends AndroidTestCase { + public void testSampleEmail() { + sanitize("\n" + + "\n" + + "HTML E-mail\n" + + "\n" + + "\n" + + "\n" + + "Body here\n" + + "
\n" + + "Link to Google Search!\n" + + "
\n" + + "
\n" + + "I am a link!\n" + + "
\n" + + "Moar body here\n" + + "\n" + + "" + , + "\n" + + "\n" + + "\n" + + "\n" + + "\n" + + "

\n" + + "Body here\n" + + "
\n" + + "Link to Google Search!\n" + + "
\n" + + "
\n" + + "I am a link!\n" + + "
\n" + + "Moar body here\n" + + "

\n"); + } + + public void testXSS() { + sanitize("'';!--\"=&{()}", "'';!--"=&{()}"); + sanitize("

", ""); + sanitize("\\\";alert('XSS');//", "\\";alert('XSS');//"); + sanitize("
", "
"); + sanitize("", ""); + sanitize("", ""); + sanitize("¼script¾alert(¢XSS¢)¼/script¾", "¼script¾alert(¢XSS¢)¼/script¾"); + sanitize("cript:alert('XSS')\">", + ""); + sanitize("", ""); + sanitize("", ""); + sanitize("\n" + + "\n" + + "\n" + + "alert(\"XSS\")" + + "\">\n" + + "", + "

\n" + + "\n" + + "\n" + + "">\n" + + "

"); + } + + /** + * Technically, RFC 2392 doesn't limit where CID urls may appear; they are accepted everywhere. + */ + public void testCIDurls() { + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + } + + // todo the stock CssSchema in OWASP does NOT allow the float property; I experiment with adding + // todo it to see how much it beautifies HTML display (the risk seems to be that you can display + // todo content outside the bounds of your div and mislead the user with this technique) + public void testCSS_float() { + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + } + + // todo the stock CssSchema in OWASP does NOT allow the display property; I experiment with + // todo adding it to see how much it beautifies HTML display (the risk seems to be that you can + // todo display content outside the bounds of your div and mislead the user with this technique) + public void testCSS_display() { + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("", ""); + sanitize("

", "

"); + sanitize("

", "

"); + } + + public void testTrimmingUrls() { + // todo Gmail strips the leading space on this href +// sanitize("Send mail", +// "Send mail"); + sanitize("Send mail", "Send mail"); + // todo Gmail strips the trailing space on this href +// sanitize("Send mail ", +// "Send mail"); + sanitize("Send mail", + "Send mail"); + // todo Gmail strips the leading and trailing spaces on this href +// sanitize("Send mail ", +// "Send mail"); + sanitize("Send mail", "Send mail"); + } + + public void testDangerousHtml() { + // body tag is translated to div tag + sanitize("arr", + "

arr

"); + sanitize("

arr

", + "

arr

"); + sanitize("arr", "arr"); + + // mailto: URLs on images are too easy to turn into DOS attacks + sanitize("

", ""); + sanitize("

", ""); + sanitize("

", ""); + sanitize("

", ""); + sanitize("

", ""); + sanitize("

", ""); + // todo Gmail doesn't escape the @ sign; OWASP does by default +// sanitize("Send mail ", +// "Send mail "); + sanitize("Send mail ", + "Send mail "); + } + + public void testSanitizingImgsWithoutSchemes() { + sanitize("

", +// "

"); // todo Gmail doesn't escape the = signs + "

"); + } + + public void testAdditionalURISchemes() { + // todo Gmail keeps a destinationless link; OWASP strips the a link completely +// sanitize("link1", "link1"); + sanitize("link1", "link1"); + // todo Gmail keeps a destinationless a link; OWASP strips the a link completely +// sanitize("link2", "link2"); + sanitize("link2", "link2"); + } + + public void testBackgroundAttribute() { + sanitize("

stuff

more stuff

", + "

stuff

more stuff

"); + } + + public void testInputImage() { + sanitize("", + ""); + } + + public void testImplicitInputImage() { + // In HTML 4.01, src attribute has meaning only when type="image" (which + // is not the default), but this happens in real life. + sanitize("", + ""); + } + + public void testSerialization() { + // N.B. (literal) newlines must not occur in CSS strings. + // todo Gmail leaves this CSS style in place and escapes it; OWASP removes it all +// sanitize("asdf", +// "asdf"); + sanitize("asdf", + "asdf"); + } + + public void testNoJS() { + // todo Gmail leaves this CSS in place and escapes it; OWASP removes it all +// sanitize("", +// ""); + sanitize("", + ""); + } + + public void testNoStyleElementByDefault() { + sanitize("" + + "

test

", + "

test

"); + } + + public void testMessageFormation() { + sanitize("

This is a simple message

", + "

This is a simple message

"); + sanitize("

This is a simple message", + "
This is a simple message
"); + sanitize("This is a simple message
", + "
This is a simple message
"); + sanitize("This is a simple message

", "This is a simple message"); + } + + public void testViolatingTags() { + sanitize("html to ruin your site" + + "" + + "" + + "" + + "" + + "" + + "This page requires frames!" + + "" + + "" + + "" + + " " + + "" + + "" + + "

" + + "Execute this

" + , + "

" + + "" + + "

" + + "Execute this

" + ); + + sanitize("Include this:
" + + "

" + + "" + , + "Include this:
" + + "
" + + "" + ); + } + + public void testLinks() { + sanitize("" + + "click here" + + "here" + + "or here" + , + "" + + "click here" + + "here" + + "or here" + ); + } + + public void testExternalLinks() { + sanitize("This is a test here " + + "

" + + "

" + + "

" + + " " + + "hey" + , + "This is a test here " + + "

" + + "

" + + "

" + ); + } + + public void testNewHtmlWhitelist() { + sanitize("link" + + "BOLD" + + "italics" + + "underlined" + + "
break
break" + + "Big_font_gone" + , + "link" + + "BOLD" + + "italics" + + "underlined" + + "
break
break" + + "Big_font_gone" + ); + } + + public void testRemoveBackticksInAttributes() { + // IE treats backticks as quotes when re-serializing, but not when parsing + sanitize(" $\"``onload=alert(1)\"$ ", + " $\"``onload=alert(1)$ "); + sanitize(" $\"'``onload=alert(1)'\"$ ", + " $\"'``onload=alert(1)'$ "); + sanitize(" $``onload=alert(1)\"$ ", " $\"``onload=alert(1)$ "); + + // Make sure we're not fooled by escaped backticks + sanitize(" $\"``onload=alert(1)\"$ ", + " $\"``onload=alert(1)$ "); + sanitize(" $\"``onload=alert(1)\"$ ", + " $\"``onload=alert(1)$ "); + + // Misc. dangerous cases: + sanitize(" `x`onload=alert(1)

`x`onload=alert(1)

", " $\"`x`onload=alert(1)$ "); + sanitize(" foo`x`onload=alert(1)

foo`x`onload=alert(1)

", + " $\"foo`x`onload=alert(1)$ "); + sanitize(" $\"`whatever\"$ Hello world ` onload=alert(1)
", + " $\"`whatever$ Hello world ` onload=alert(1)
"); + + // The tokenizer doesn't see these as entities because they lack a trailing semicolon, so it + // escapes the leading ampersands. + sanitize(" $\"``onload=alert(1)\"$ ", + " $\"`&#x000060onload=alert(1)$ "); + + // Here there are no actual backticks, though there would be if we (or IE) did repeated + // unescaping. + sanitize(" $\"&#x000060&#x000060onload=alert(2)\"$ ", + " $\"&#x000060&#x000060onload=alert(2)\"$ "); + sanitize(" $\"&#x000060&#x000060onload=alert(2)\"$ ", + " $\"&#x000060&#x000060onload=alert(2)\"$ "); + } + + public void testMakeSafeStyle() { + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("", + ""); + + // check for CSS3 border-radius + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + + // allow positive margins + sanitize("

", + "

"); + sanitize("

", + "

"); + + // negative margin would allow it to slip out of the box + sanitize("

", "

"); + + // allow positive text-ident + sanitize("

", "

"); + sanitize("

", "

"); + + // todo Gmail disallows negative text-indents; OWASP is fine with them + // negative text-indent would allow it to slip out of the box +// sanitize("

", "

"); + sanitize("

", "

"); + } + + public void testMakeSafeStyleWithQuotedStrings() { + sanitize("

", + "

" +
+                        "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + } + + public void testSeriouslyNoBackgroundImages() { + sanitize("

", + "

"); + sanitize("

", + "

"); + + sanitize("

", "

"); + sanitize("

", "

"); + } + + public void testExpression() { + sanitize("

", "

"); + } + + public void testStrayUrlConsideredHarmful() { + sanitize("

", "

"); + sanitize("

", "

"); + } + + public void testObjectionableFunctions() { + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + } + + public void testAbsolutePositionBanned() { + sanitize("

", "

"); + } + + public void testNoTextShadow() { + // todo Gmail disallows this text-shadow; OWASP is fine with it +// sanitize("

", "

"); + sanitize("

", + "

"); + } + + public void testToStyle() { + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", "

"); + sanitize("

", + "

"); + sanitize("

", "

"); + } + + public void testNoColorStrings() { + sanitize("

", "

"); + } + + public void testTolerateMalformedBorder() { + sanitize("

", "

"); + } + + public void testRgba() { + sanitize("

", + "

"); + } + + public void testFontStyle() { + // todo Gmail accepts !important while OWASP discards it; this is only beauty, not security +// sanitize("

", +// "

"); + sanitize("

", + "

"); + // todo Gmail accepts !important while OWASP discards it; this is only beauty, not security +// sanitize("

", +// "

"); + sanitize("

", + "

"); + sanitize("

", + "

"); + } + + private void sanitize(String dirtyHTML, String expectedHTML) { + final String cleansedHTML = HtmlSanitizer.sanitizeHtml(dirtyHTML); + assertEquals(expectedHTML, cleansedHTML); + } +} diff --git a/tests/src/com/android/mail/utils/BasicHtmlSanitizerTest.java b/tests/src/com/android/mail/utils/BasicHtmlSanitizerTest.java new file mode 100644 index 000000000..d0e23abe7 --- /dev/null +++ b/tests/src/com/android/mail/utils/BasicHtmlSanitizerTest.java @@ -0,0 +1,1055 @@ +package com.android.mail.utils; + +import android.test.AndroidTestCase; +import android.test.suitebuilder.annotation.SmallTest; + +/** + * These test cases verify that each white listed element and attribute is accepted by the sanitizer + * and everything else is correctly discarded. + */ +@SmallTest +public class BasicHtmlSanitizerTest extends AndroidTestCase { + public void testAttributeDir() { + sanitize("

something

", "

something

"); + sanitize("

something

", "

something

"); + sanitize("

something

", "

something

"); + sanitize("

something

", "

something

"); + sanitize("

something

", "

something

"); + } + + public void testA() { + // allowed attributes + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + + // disallowed attributes (all links should launch a browser so we don't need these) + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("xxs link", "xxs link"); + sanitize("xxs link", "xxs link"); + sanitize("xxs link", "xxs link"); + sanitize("exp/*", "exp/*"); + } + + public void testAbbr() { + sanitize("UK", + "UK"); + } + + public void testAcronym() { + sanitize("WWW", + "WWW"); + } + + public void testAddress() { + sanitize("

"); + } + + public void testApplet() { + // todo Gmail would also strip "malicious applet" as well... is this a problem? + sanitize("malicious applet", "malicious applet"); + } + + public void testArea() { + // allowed attributes + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + + // disallowed attributes (all links launch a browser so we don't need these attributes) + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testArticle() { + sanitize("

"); + } + + public void testAside() { + sanitize("", ""); + } + + public void testAudio() { + sanitize("

", "not supported"); + } + + public void testB() { + sanitize("something", "something"); + } + + public void testBase() { + // allowed attributes + sanitize("", + ""); + + // disallowed attributes + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testBasefont() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testBdi() { + sanitize("something", "something"); + sanitize("something", "something"); + } + + public void testBdo() { + sanitize("something", "something"); + sanitize("something", "something"); + } + + public void testBgsound() { + sanitize("", ""); + sanitize("", ""); + } + + public void testBig() { + sanitize("something", "something"); + } + + public void testBlink() { + sanitize("something", "something"); + } + + public void testBlockquote() { + sanitize("

something

something

"); + sanitize("

something

something

"); + sanitize("

something

something

"); + + sanitize("

", + "
"); + } + + /** + * The body tag will be supplied by code that wraps this email with other formatting logic. + * So, any body tags appearing within the email are translated to div tags. + */ + public void testBody() { + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + + // take extra care to ensure that these scripting callbacks don't survive + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + sanitize("", "
"); + } + + public void testBr() { + sanitize("something
something", "something
something"); + sanitize("something
something", "something
something"); + } + + public void testButton() { + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + + sanitize("", + ""); + } + + public void testCanvas() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testCaption() { + sanitize("something", "something"); + sanitize("something", + "something"); + } + + public void testCenter() { + sanitize("something", "something"); + } + + public void testCite() { + sanitize("something", "something"); + } + + public void testCode() { + sanitize("something", "something"); + } + + public void testCol() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testColgroup() { + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + } + + public void testDatalist() { + sanitize("", ""); + } + + public void testDd() { + sanitize("
something
", "
something
"); + } + + public void testDel() { + sanitize("~~something~~", "~~something~~"); + sanitize("~~something~~", "~~something~~"); + sanitize("~~something~~", + "~~something~~"); + sanitize("~~something~~", + "~~something~~"); + } + + public void testDetails() { + sanitize("
something
", "
something
"); + } + + public void testDfn() { + sanitize("something", "something"); + } + + public void testDialog() { + sanitize("This is an open dialog window", + "This is an open dialog window"); + } + + public void testDir() { + sanitize("
something
", "
something
"); + sanitize("
something
", + "
something
"); + } + + public void testDiv() { + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", + "
"); + + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", + "
"); + } + + public void testDl() { + sanitize("
", "
"); + } + + public void testDt() { + sanitize("
", "
"); + } + + public void testEm() { + sanitize("something", "something"); + } + + public void testEmbed() { + sanitize("", ""); + } + + public void testFieldset() { + sanitize("
something
", "
something
"); + sanitize("
something
", + "
something
"); + sanitize("
something
", + "
something
"); + sanitize("
something
", + "
something
"); + } + + public void testFigcaption() { + sanitize("
Fig1. something
", + "
Fig1. something
"); + } + + public void testFigure() { + sanitize("
something
", "
something
"); + } + + public void testFont() { + sanitize("something", "something"); + sanitize("something", "something"); + sanitize("something", + "something"); + sanitize("something", "something"); + } + + public void testFooter() { + sanitize("
something
", "
something
"); + } + + public void testForm() { + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", + "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", + "
"); + sanitize("
", "
"); + sanitize("
", + "
"); + + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + } + + public void testFrame() { + sanitize("", ""); + } + + public void testFrameset() { + sanitize("", ""); + sanitize("", ""); + } + + public void testHead() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testHeader() { + sanitize("
", "
"); + } + + public void testH1() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testH2() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testH3() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testH4() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testH5() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testH6() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testHr() { + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + } + + public void testHtml() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testI() { + sanitize("", ""); + } + + public void testIframe() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testIsindex() { + sanitize("", ""); + } + + public void testImg() { + sanitize("", ""); + sanitize("", ""); + sanitize(" $\"something\"/$ ", " $\"something\"$ "); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("\">", "">"); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testInput() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + } + + public void testIns() { + sanitize("something", "something"); + sanitize("something", "something"); + sanitize("something", + "something"); + sanitize("something", + "something"); + } + + public void testKbd() { + sanitize("something", "something"); + } + + public void testKeygen() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testLabel() { + sanitize("Something:", "Something:"); + sanitize("Something:", + "Something:"); + } + + public void testLegend() { + sanitize("Something:", "Something:"); + sanitize("Something:", + "Something:"); + } + + public void testLi() { + sanitize("
Something:
", "
Something:
"); + sanitize("
Something:
", "
Something:
"); + sanitize("
Something:
", "
Something:
"); + } + + public void testLink() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testMain() { + sanitize("
something
", "
something
"); + } + + public void testMap() { + sanitize("", ""); + sanitize("", ""); + } + + public void testMark() { + sanitize("something", "something"); + } + + public void testMenu() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testMenuitem() { + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + + sanitize("", ""); + } + + public void testMeta() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("; " + + "REL=stylesheet\">", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testMeter() { + sanitize("2 out of 10", "2 out of 10"); + sanitize("2 out of 10", + "2 out of 10"); + sanitize("2 out of 10", + "2 out of 10"); + sanitize("2 out of 10", "2 out of 10"); + sanitize("2 out of 10", "2 out of 10"); + sanitize("2 out of 10", "2 out of 10"); + sanitize("2 out of 10", + "2 out of 10"); + sanitize("2 out of 10", + "2 out of 10"); + } + + public void testNav() { + sanitize("
something
", "
something
"); + } + + public void testNoframes() { + sanitize("", ""); + } + + public void testNoscript() { + sanitize("", ""); + } + + public void testObject() { + sanitize("", ""); + sanitize("", ""); + } + + public void testOl() { + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + } + + public void testOptgroup() { + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + } + + public void testOption() { + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + } + + public void testOutput() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testP() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testParam() { + sanitize("", ""); + } + + public void testPre() { + sanitize("
something
", "
something
"); + sanitize("
something
", "
something
"); + } + + public void testProgress() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testQ() { + sanitize("something", "something"); + sanitize("something", + "something"); + sanitize("something", "something"); + } + + public void testRp() { + sanitize("something", "something"); + } + + public void testRt() { + sanitize("something", "something"); + } + + public void testRuby() { + sanitize("", ""); + } + + public void testS() { + sanitize("~~old skool strikethrough~~", "~~old skool strikethrough~~"); + } + + public void testSamp() { + sanitize("something", "something"); + } + + public void testScript() { + sanitize("", ""); + sanitize("<", "<"); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + + String attack = "';alert(String.fromCharCode(88,83,83))//';" + + "alert(String.fromCharCode(88,83,83))//\";\n" + + "alert(String.fromCharCode(88,83,83))//\";" + + "alert(String.fromCharCode(88,83,83))//--\n" + + ">\">'>"; + String defend = "';alert(String.fromCharCode(88,83,83))//';" + + "alert(String.fromCharCode(88,83,83))//";\n" + + "alert(String.fromCharCode(88,83,83))//";" + + "alert(String.fromCharCode(88,83,83))//--\n" + + ">">'>"; + sanitize(attack, defend); + } + + public void testSection() { + sanitize("
something
", "
something
"); + } + + public void testSelect() { + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", ""); + } + + public void testSmall() { + sanitize("something", "something"); + } + + public void testSource() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", ""); + } + + public void testSpan() { + sanitize("something", + "something"); + } + + public void testStrike() { + sanitize("~~something~~", "~~something~~"); + } + + public void testStrong() { + sanitize("something", "something"); + } + + public void testStyle() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", ""); + sanitize("", ""); + sanitize("" + + "", ""); + sanitize("", ""); + } + + public void testSub() { + sanitize("_something", "_something"); + } + + public void testSummary() { + sanitize("
something
", "
something
"); + } + + public void testSup() { + sanitize("^something", "^something"); + } + + public void testTable() { + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + sanitize("
", "
"); + + sanitize("", "
"); + } + + public void testTbody() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testTd() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + + sanitize("", ""); + sanitize("", ""); + } + + public void testTextarea() { + sanitize("", ""); + sanitize("", + ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", + ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testTfoot() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testTh() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + + sanitize("", ""); + } + + public void testThead() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testTime() { + sanitize("", ""); + sanitize("", ""); + } + + public void testTitle() { + sanitize("something", ""); + } + + public void testTr() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + } + + public void testTrack() { + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", ""); + sanitize("", + ""); + sanitize("", ""); + + sanitize("", ""); + } + + public void testTt() { + sanitize("something", "something"); + } + + public void testU() { + sanitize("something", "something"); + } + + public void testUl() { + sanitize("
", "
"); + sanitize("
", "
"); + } + + public void testVar() { + sanitize("something", "something"); + } + + public void testVideo() { + sanitize("", ""); + } + + public void testWbr() { + sanitize("word1word2", "word1word2"); + } + + private void sanitize(String dirtyHTML, String expectedHTML) { + final String cleansedHTML = HtmlSanitizer.sanitizeHtml(dirtyHTML); + assertEquals(expectedHTML, cleansedHTML); + } +} -- cgit v1.2.3