| | |
|---|
| | | //$this->assertNoPattern('/<style [^>]+>/', $html, "No style tags allowed"); |
|---|
| | | $this->assertNoPattern('/<form [^>]+>/', $html, "No form tags allowed"); |
|---|
| | | $this->assertPattern('/Subscription form/', $html, "Include <form> contents"); |
|---|
| | | $this->assertPattern('/<!-- input ignored -->/', $html, "No input elements allowed"); |
|---|
| | | $this->assertPattern('/<!-- link ignored -->/', $html, "No external links allowed"); |
|---|
| | | $this->assertPattern('/<a[^>]+ target="_blank">/', $html, "Set target to _blank"); |
|---|
| | | $this->assertTrue($GLOBALS['REMOTE_OBJECTS'], "Remote object detected"); |
|---|
| | |
|---|
| | | function test_html_xss2() |
|---|
| | | { |
|---|
| | | $part = $this->get_html_part('src/BID-26800.txt'); |
|---|
| | | $washed = rcmail_print_body($part, array('safe' => true)); |
|---|
| | | $washed = rcmail_html4inline(rcmail_print_body($part, array('safe' => true)), 'dabody', '', $attr, true); |
|---|
| | | |
|---|
| | | $this->assertNoPattern('/alert|expression|javascript|xss/', $washed, "Remove evil style blocks"); |
|---|
| | | $this->assertNoPattern('/font-style:italic/', $washed, "Allow valid styles"); |
|---|
| | | } |
|---|
| | | |
|---|
| | | /** |
|---|
| | | * Test washtml class on non-unicode characters (#1487813) |
|---|
| | | */ |
|---|
| | | function test_washtml_utf8() |
|---|
| | | { |
|---|
| | | $part = $this->get_html_part('src/invalidchars.html'); |
|---|
| | | $washed = rcmail_print_body($part); |
|---|
| | | |
|---|
| | | $this->assertPattern('/<p>символ<\/p>/', $washed, "Remove non-unicode characters from HTML message body"); |
|---|
| | | } |
|---|
| | | |
|---|
| | | /** |
|---|
| | |
|---|
| | | $this->assertPattern('|src="http://alec\.pl/dir/img1\.gif"|', $html, "URI base resolving [1]"); |
|---|
| | | $this->assertPattern('|src="http://alec\.pl/dir/img2\.gif"|', $html, "URI base resolving [2]"); |
|---|
| | | $this->assertPattern('|src="http://alec\.pl/img3\.gif"|', $html, "URI base resolving [3]"); |
|---|
| | | |
|---|
| | | // base resolving exceptions |
|---|
| | | $this->assertPattern('|src="cid:theCID"|', $html, "URI base resolving exception [1]"); |
|---|
| | | $this->assertPattern('|src="http://other\.domain\.tld/img3\.gif"|', $html, "URI base resolving exception [2]"); |
|---|
| | | } |
|---|
| | | } |
|---|
