| | |
|---|
| | | function test_html_xss2() |
|---|
| | | { |
|---|
| | | $part = $this->get_html_part('src/BID-26800.txt'); |
|---|
| | | $washed = rcmail_print_body($part, array('safe' => true)); |
|---|
| | | $washed = rcmail_html4inline(rcmail_print_body($part, array('safe' => true)), 'dabody', '', $attr, true); |
|---|
| | | |
|---|
| | | $this->assertNoPattern('/alert|expression|javascript|xss/', $washed, "Remove evil style blocks"); |
|---|
| | | $this->assertNoPattern('/font-style:italic/', $washed, "Allow valid styles"); |
|---|
| | |
|---|
| | | $this->assertPattern('|src="http://alec\.pl/dir/img1\.gif"|', $html, "URI base resolving [1]"); |
|---|
| | | $this->assertPattern('|src="http://alec\.pl/dir/img2\.gif"|', $html, "URI base resolving [2]"); |
|---|
| | | $this->assertPattern('|src="http://alec\.pl/img3\.gif"|', $html, "URI base resolving [3]"); |
|---|
| | | |
|---|
| | | // base resolving exceptions |
|---|
| | | $this->assertPattern('|src="cid:theCID"|', $html, "URI base resolving exception [1]"); |
|---|
| | | $this->assertPattern('|src="http://other\.domain\.tld/img3\.gif"|', $html, "URI base resolving exception [2]"); |
|---|
| | | } |
|---|
| | | } |
|---|
