tests/xss_filter_test.php

   1 <?php
   2 /**
   3 * Tests, without pHPUnit by now
   4 * @package test.util
   5 */
   6
   7 require_once('include/text.php');
   8
   9 class AntiXSSTest extends PHPUnit_Framework_TestCase {
  10
  11 /**
  12 * test no tags
  13 */
  14         public function testEscapeTags() {
  15                 $invalidstring='<submit type="button" onclick="alert(\'failed!\');" />';
  16
  17                 $validstring=notags($invalidstring);
  18                 $escapedString=escape_tags($invalidstring);
  19
  20                 $this->assertEquals('[submit type="button" onclick="alert(\'failed!\');" /]', $validstring);
  21                 $this->assertEquals("&lt;submit type=&quot;button&quot; onclick=&quot;alert('failed!');&quot; /&gt;", $escapedString);
  22         }
  23
  24         /**
  25          *autonames should be random, even length
  26          */
  27         public function testAutonameEven() {
  28                 $autoname1=autoname(10);
  29                 $autoname2=autoname(10);
  30
  31                 $this->assertNotEquals($autoname1, $autoname2);
  32         }
  33
  34         /**
  35          *autonames should be random, odd length
  36          */
  37         public function testAutonameOdd() {
  38                 $autoname1=autoname(9);
  39                 $autoname2=autoname(9);
  40
  41                 $this->assertNotEquals($autoname1, $autoname2);
  42         }
  43
  44         /**
  45          * try to fail autonames
  46          */
  47         public function testAutonameNoLength() {
  48                 $autoname1=autoname(0);
  49                 $this->assertEquals(0, count($autoname1));
  50         }
  51
  52         public function testAutonameNegativeLength() {
  53                 $autoname1=autoname(-23);
  54                 $this->assertEquals(0, count($autoname1));
  55         }
  56
  57 //      public function testAutonameMaxLength() {
  58 //              $autoname2=autoname(PHP_INT_MAX);
  59 //              $this->assertEquals(PHP_INT_MAX, count($autoname2));
  60 //      }
  61
  62         public function testAutonameLength1() {
  63                 $autoname3=autoname(1);
  64                 $this->assertEquals(1, count($autoname3));
  65         }
  66
  67         /**
  68          *xmlify and unxmlify
  69          */
  70         public function testXmlify() {
  71                 $text="<tag>I want to break\n this!11!<?hard?></tag>";
  72                 $xml=xmlify($text); //test whether it actually may be part of a xml document
  73                 $retext=unxmlify($text);
  74
  75                 $this->assertEquals($text, $retext);
  76         }
  77
  78         /**
  79          * test hex2bin and reverse
  80          */
  81
  82         public function testHex2Bin() {
  83                 $this->assertEquals(-3, hex2bin(bin2hex(-3)));
  84                 $this->assertEquals(0, hex2bin(bin2hex(0)));
  85                 $this->assertEquals(12, hex2bin(bin2hex(12)));
  86                 $this->assertEquals(PHP_INT_MAX, hex2bin(bin2hex(PHP_INT_MAX)));
  87         }
  88
  89         /**
  90          * test expand_acl
  91          */
  92         public function testExpandAclNormal() {
  93                 $text="<1><2><3>";
  94                 $this->assertEquals(array(1, 2, 3), expand_acl($text));
  95         }
  96
  97         public function testExpandAclBigNumber() {
  98                 $text="<1><279012><15>";
  99                 $this->assertEquals(array(1, 279012, 15), expand_acl($text));
 100         }
 101
 102         public function testExpandAclString() {
 103                 $text="<1><279012><tt>"; //maybe that's invalid
 104                 $this->assertEquals(array(1, 279012, 'tt'), expand_acl($text));
 105         }
 106
 107         public function testExpandAclSpace() {
 108                 $text="<1><279 012><32>"; //maybe that's invalid
 109                 $this->assertEquals(array(1, "279 012", "32"), expand_acl($text));
 110         }
 111
 112         public function testExpandAclEmpty() {
 113                 $text=""; //maybe that's invalid
 114                 $this->assertEquals(array(), expand_acl($text));
 115         }
 116
 117         public function testExpandAclNoBrackets() {
 118                 $text="According to documentation, that's invalid. "; //should be invalid
 119                 $this->assertEquals(array(), expand_acl($text));
 120         }
 121
 122         public function testExpandAclJustOneBracket1() {
 123                 $text="<Another invalid string"; //should be invalid
 124                 $this->assertEquals(array(), expand_acl($text));
 125         }
 126
 127         public function testExpandAclJustOneBracket2() {
 128                 $text="Another invalid> string"; //should be invalid
 129                 $this->assertEquals(array(), expand_acl($text));
 130         }
 131
 132         public function testExpandAclCloseOnly() {
 133                 $text="Another> invalid> string>"; //should be invalid
 134                 $this->assertEquals(array(), expand_acl($text));
 135         }
 136
 137         public function testExpandAclOpenOnly() {
 138                 $text="<Another< invalid string<"; //should be invalid
 139                 $this->assertEquals(array(), expand_acl($text));
 140         }
 141
 142         public function testExpandAclNoMatching1() {
 143                 $text="<Another<> invalid <string>"; //should be invalid
 144                 $this->assertEquals(array(), expand_acl($text));
 145         }
 146
 147         public function testExpandAclNoMatching2() {
 148                 $text="<1>2><3>";
 149                 $this->assertEquals(array(), expand_acl($text));
 150         }
 151
 152         /**
 153          * test attribute contains
 154          */
 155         public function testAttributeContains1() {
 156                 $testAttr="class1 notclass2 class3";
 157                 $this->assertTrue(attribute_contains($testAttr, "class3"));
 158                 $this->assertFalse(attribute_contains($testAttr, "class2"));
 159         }
 160
 161         /**
 162          * test attribute contains
 163          */
 164         public function testAttributeContains2() {
 165                 $testAttr="class1 not-class2 class3";
 166                 $this->assertTrue(attribute_contains($testAttr, "class3"));
 167                 $this->assertFalse(attribute_contains($testAttr, "class2"));
 168         }
 169
 170         public function testAttributeContainsEmpty() {
 171                 $testAttr="";
 172                 $this->assertFalse(attribute_contains($testAttr, "class2"));
 173         }
 174
 175         public function testAttributeContainsSpecialChars() {
 176                 $testAttr="--... %\$ä() /(=?}";
 177                 $this->assertFalse(attribute_contains($testAttr, "class2"));
 178         }
 179
 180         /**
 181          * test get_tags
 182          */
 183         public function testGetTags() {
 184                 $text="hi @Mike, I'm just writing #test_cases, "
 185                 ." so @somebody@friendica.com may change #things. Of course I "
 186                 ."look for a lot of #pitfalls, like #tags at the end of a sentence "
 187                 ."@comment. I hope noone forgets about @fullstops.because that might"
 188                 ." break #things. @Mike@campino@friendica.eu is also #nice, isn't it? "
 189                 ."Now, add a @first_last tag. ";
 190                 //check whether this are all variants (no, auto-stuff is missing).
 191
 192                 $tags=get_tags($text);
 193
 194                 $this->assertEquals("@Mike", $tags[0]);
 195                 $this->assertEquals("#test_cases", $tags[1]);
 196                 $this->assertEquals("@somebody@friendica.com", $tags[2]);
 197                 $this->assertEquals("#things", $tags[3]);
 198                 $this->assertEquals("#pitfalls", $tags[4]);
 199                 $this->assertEquals("#tags", $tags[5]);
 200                 $this->assertEquals("@comment", $tags[6]);
 201                 $this->assertEquals("@fullstops", $tags[7]);
 202                 $this->assertEquals("#things", $tags[8]);
 203                 $this->assertEquals("@Mike", $tags[9]);
 204                 $this->assertEquals("@campino@friendica.eu", $tags[10]);
 205                 $this->assertEquals("#nice", $tags[11]);
 206                 $this->assertEquals("@first_last", $tags[12]);
 207         }
 208
 209         public function testGetTagsEmpty() {
 210                 $tags=get_tags("");
 211                 $this->assertEquals(0, count($tags));
 212         }
 213 //function qp, quick and dirty??
 214 //get_mentions
 215 //get_contact_block, bis Zeile 538
 216 }
 217 ?>