| | |
| | | $part->replaces = array('ex1.jpg' => 'part_1.2.jpg', 'ex2.jpg' => 'part_1.2.jpg'); |
| | | |
| | | // render HTML in normal mode |
| | | $html = rcmail_html4inline(rcmail_print_body($part, array('safe' => false)), 'foo'); |
| | | $html = rcmail_html4inline(rcmail_print_body($part->body, $part, array('safe' => false)), 'foo'); |
| | | |
| | | $this->assertRegExp('/src="'.$part->replaces['ex1.jpg'].'"/', $html, "Replace reference to inline image"); |
| | | $this->assertRegExp('#background="./program/resources/blocked.gif"#', $html, "Replace external background image"); |
| | |
| | | $this->assertTrue($GLOBALS['REMOTE_OBJECTS'], "Remote object detected"); |
| | | |
| | | // render HTML in safe mode |
| | | $html2 = rcmail_html4inline(rcmail_print_body($part, array('safe' => true)), 'foo'); |
| | | $html2 = rcmail_html4inline(rcmail_print_body($part->body, $part, array('safe' => true)), 'foo'); |
| | | |
| | | $this->assertRegExp('/<style [^>]+>/', $html2, "Allow styles in safe mode"); |
| | | $this->assertRegExp('#src="http://evilsite.net/mailings/ex3.jpg"#', $html2, "Allow external images in HTML (safe mode)"); |
| | | $this->assertRegExp("#url\('?http://evilsite.net/newsletter/image/bg/bg-64.jpg'?\)#", $html2, "Allow external images in CSS (safe mode)"); |
| | | $css = '<link rel="stylesheet" .+_u=tmp-[a-z0-9]+\.css.+_action=modcss'; |
| | | $css = '<link rel="stylesheet" .+_action=modcss.+_u=tmp-[a-z0-9]+\.css'; |
| | | $this->assertRegExp('#'.$css.'#Ui', $html2, "Filter (anonymized) external styleseehts with utils/modcss.inc"); |
| | | } |
| | | |
| | |
| | | function test_html_xss() |
| | | { |
| | | $part = $this->get_html_part('src/htmlxss.txt'); |
| | | $washed = rcmail_print_body($part, array('safe' => true)); |
| | | $washed = rcmail_print_body($part->body, $part, array('safe' => true)); |
| | | |
| | | $this->assertNotRegExp('/src="skins/', $washed, "Remove local references"); |
| | | $this->assertNotRegExp('/\son[a-z]+/', $washed, "Remove on* attributes"); |
| | |
| | | function test_html_xss2() |
| | | { |
| | | $part = $this->get_html_part('src/BID-26800.txt'); |
| | | $washed = rcmail_html4inline(rcmail_print_body($part, array('safe' => true)), 'dabody', '', $attr, true); |
| | | $washed = rcmail_html4inline(rcmail_print_body($part->body, $part, array('safe' => true)), 'dabody', '', $attr, true); |
| | | |
| | | $this->assertNotRegExp('/alert|expression|javascript|xss/', $washed, "Remove evil style blocks"); |
| | | $this->assertNotRegExp('/font-style:italic/', $washed, "Allow valid styles"); |
| | |
| | | function test_washtml_utf8() |
| | | { |
| | | $part = $this->get_html_part('src/invalidchars.html'); |
| | | $washed = rcmail_print_body($part); |
| | | $washed = rcmail_print_body($part->body, $part); |
| | | |
| | | $this->assertRegExp('/<p>символ<\/p>/', $washed, "Remove non-unicode characters from HTML message body"); |
| | | } |
| | |
| | | $part->ctype_primary = 'text'; |
| | | $part->ctype_secondary = 'plain'; |
| | | $part->body = quoted_printable_decode(file_get_contents(TESTS_DIR . 'src/plainbody.txt')); |
| | | $html = rcmail_print_body($part, array('safe' => true)); |
| | | $html = rcmail_print_body($part->body, $part, array('safe' => true)); |
| | | |
| | | $this->assertRegExp('/<a href="mailto:nobody@roundcube.net" onclick="return rcmail.command\(\'compose\',\'nobody@roundcube.net\',this\)">nobody@roundcube.net<\/a>/', $html, "Mailto links with onclick"); |
| | | $this->assertRegExp('#<a rel="noreferrer" target="_blank" href="http://www.apple.com/legal/privacy">http://www.apple.com/legal/privacy</a>#', $html, "Links with target=_blank"); |
| | |
| | | $part = $this->get_html_part('src/mailto.txt'); |
| | | |
| | | // render HTML in normal mode |
| | | $html = rcmail_html4inline(rcmail_print_body($part, array('safe' => false)), 'foo'); |
| | | $html = rcmail_html4inline(rcmail_print_body($part->body, $part, array('safe' => false)), 'foo'); |
| | | |
| | | $mailto = '<a href="mailto:me@me.com"' |
| | | .' onclick="return rcmail.command(\'compose\',\'me@me.com?subject=this is the subject&body=this is the body\',this)" rel="noreferrer">e-mail</a>'; |
| | |
| | | function test_html_comments() |
| | | { |
| | | $part = $this->get_html_part('src/htmlcom.txt'); |
| | | $washed = rcmail_print_body($part, array('safe' => true)); |
| | | $washed = rcmail_print_body($part->body, $part, array('safe' => true)); |
| | | |
| | | // #1487759 |
| | | $this->assertRegExp('|<p>test1</p>|', $washed, "Buggy HTML comments"); |
| | |
| | | |
| | | $this->assertSame($identities[1], $res); |
| | | } |
| | | |
| | | /** |
| | | * Test identities selection (#1489378) |
| | | */ |
| | | function test_rcmail_identity_select2() |
| | | { |
| | | $identities = array( |
| | | array( |
| | | 'name' => 'Test 1', |
| | | 'email_ascii' => 'addr1@domain.tld', |
| | | 'ident' => 'Test 1 <addr1@domain.tld>', |
| | | ), |
| | | array( |
| | | 'name' => 'Test 2', |
| | | 'email_ascii' => 'addr2@domain.tld', |
| | | 'ident' => 'Test 2 <addr2@domain.tld>', |
| | | ), |
| | | array( |
| | | 'name' => 'Test 3', |
| | | 'email_ascii' => 'addr3@domain.tld', |
| | | 'ident' => 'Test 3 <addr3@domain.tld>', |
| | | ), |
| | | array( |
| | | 'name' => 'Test 4', |
| | | 'email_ascii' => 'addr2@domain.tld', |
| | | 'ident' => 'Test 4 <addr2@domain.tld>', |
| | | ), |
| | | ); |
| | | |
| | | $message = new stdClass; |
| | | $message->headers = new rcube_message_header; |
| | | |
| | | $message->headers->set('From', '<addr2@domain.tld>'); |
| | | $res = rcmail_identity_select($message, $identities); |
| | | $this->assertSame($identities[1], $res); |
| | | |
| | | $message->headers->set('From', 'Test 2 <addr2@domain.tld>'); |
| | | $res = rcmail_identity_select($message, $identities); |
| | | $this->assertSame($identities[1], $res); |
| | | |
| | | $message->headers->set('From', 'Other <addr2@domain.tld>'); |
| | | $res = rcmail_identity_select($message, $identities); |
| | | $this->assertSame($identities[1], $res); |
| | | |
| | | $message->headers->set('From', 'Test 4 <addr2@domain.tld>'); |
| | | $res = rcmail_identity_select($message, $identities); |
| | | $this->assertSame($identities[3], $res); |
| | | } |
| | | } |