diff options
| author |  tobi <31960611+tsmethurst@users.noreply.github.com> | 2023-08-11 14:40:11 +0200 |
|---|---|---|
| committer |  GitHub <noreply@github.com> | 2023-08-11 14:40:11 +0200 |
| commit | dc96562b4084e058846aea9102ef0257461717d6 (patch) | |
| tree | a0b4bdbaa266386c7fdbbc02ca3e62bae559bf17 /internal/text/sanitize_test.go | |
| parent | [feature] Set Content-Security-Policy header (#2095) (diff) | |
| download | gotosocial-dc96562b4084e058846aea9102ef0257461717d6.tar.xz | |
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100)
Diffstat (limited to 'internal/text/sanitize_test.go')
| -rw-r--r-- | internal/text/sanitize_test.go | 28 |
1 files changed, 17 insertions, 11 deletions
diff --git a/internal/text/sanitize_test.go b/internal/text/sanitize_test.go index f299c2923..ae49c942c 100644 --- a/internal/text/sanitize_test.go +++ b/internal/text/sanitize_test.go @@ -36,30 +36,30 @@ type SanitizeTestSuite struct { } func (suite *SanitizeTestSuite) TestSanitizeOutgoing() { - s := text.SanitizeHTML(sanitizeOutgoing) + s := text.SanitizeToHTML(sanitizeOutgoing) suite.Equal(sanitizedOutgoing, s) } func (suite *SanitizeTestSuite) TestSanitizeHTML() { - s := text.SanitizeHTML(sanitizeHTML) + s := text.SanitizeToHTML(sanitizeHTML) suite.Equal(sanitizedHTML, s) } func (suite *SanitizeTestSuite) TestSanitizeCaption1() { dodgyCaption := "<script>console.log('haha!')</script>this is just a normal caption ;)" - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("this is just a normal caption ;)", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption2() { dodgyCaption := "<em>here's a LOUD caption</em>" - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("here's a LOUD caption", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption3() { dodgyCaption := "" - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("", sanitized) } @@ -75,21 +75,21 @@ with some newlines ` - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("here is\na multi line\ncaption\nwith some newlines", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption5() { // html-escaped: "<script>console.log('aha!')</script> hello world" dodgyCaption := `<script>console.log('aha!')</script> hello world` - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("hello world", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption6() { // html-encoded: "<script>console.log('aha!')</script> hello world" dodgyCaption := `<script>console.log('aha!')</script> hello world` - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("hello world", sanitized) } @@ -104,24 +104,30 @@ func (suite *SanitizeTestSuite) TestSanitizeCustomCSS() { overflow: hidden; text-overflow: ellipsis; }` - sanitized := text.SanitizePlaintext(customCSS) + sanitized := text.SanitizeToPlaintext(customCSS) suite.Equal(customCSS, sanitized) // should be the same as it was before } func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS1() { // try to break out of <style> into <head> and change the document title customCSS := "</style><title>pee pee poo poo</title><style>" - sanitized := text.SanitizePlaintext(customCSS) + sanitized := text.SanitizeToPlaintext(customCSS) suite.Empty(sanitized) } func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS2() { // try to break out of <style> into <head> and change the document title customCSS := "pee pee poo poo</style><title></title><style>" - sanitized := text.SanitizePlaintext(customCSS) + sanitized := text.SanitizeToPlaintext(customCSS) suite.Equal("pee pee poo poo", sanitized) } +func (suite *SanitizeTestSuite) TestSanitizeInlineImg() { + withInlineImg := "<p>Here's an inline image: <img class=\"fixed-size-img svelte-uci8eb\" aria-hidden=\"false\" alt=\"A black-and-white photo of an Oblique Strategy card. The card reads: 'Define an area as 'safe' and use it as an anchor'.\" title=\"A black-and-white photo of an Oblique Strategy card. The card reads: 'Define an area as 'safe' and use it as an anchor'.\" width=\"0\" height=\"0\" src=\"https://example.org/fileserver/01H7J83147QMCE17C0RS9P10Y9/attachment/small/01H7J8365XXRTCP6CAMGEM49ZE.jpg\" style=\"object-position: 50% 50%;\"></p>" + sanitized := text.SanitizeToHTML(withInlineImg) + suite.Equal(`<p>Here's an inline image: </p>`, sanitized) +} + func TestSanitizeTestSuite(t *testing.T) { suite.Run(t, new(SanitizeTestSuite)) } |