From dc96562b4084e058846aea9102ef0257461717d6 Mon Sep 17 00:00:00 2001 From: tobi <31960611+tsmethurst@users.noreply.github.com> Date: Fri, 11 Aug 2023 14:40:11 +0200 Subject: [bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) --- internal/text/sanitize_test.go | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) (limited to 'internal/text/sanitize_test.go') diff --git a/internal/text/sanitize_test.go b/internal/text/sanitize_test.go index f299c2923..ae49c942c 100644 --- a/internal/text/sanitize_test.go +++ b/internal/text/sanitize_test.go @@ -36,30 +36,30 @@ type SanitizeTestSuite struct { } func (suite *SanitizeTestSuite) TestSanitizeOutgoing() { - s := text.SanitizeHTML(sanitizeOutgoing) + s := text.SanitizeToHTML(sanitizeOutgoing) suite.Equal(sanitizedOutgoing, s) } func (suite *SanitizeTestSuite) TestSanitizeHTML() { - s := text.SanitizeHTML(sanitizeHTML) + s := text.SanitizeToHTML(sanitizeHTML) suite.Equal(sanitizedHTML, s) } func (suite *SanitizeTestSuite) TestSanitizeCaption1() { dodgyCaption := "this is just a normal caption ;)" - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("this is just a normal caption ;)", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption2() { dodgyCaption := "here's a LOUD caption" - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("here's a LOUD caption", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption3() { dodgyCaption := "" - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("", sanitized) } @@ -75,21 +75,21 @@ with some newlines ` - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("here is\na multi line\ncaption\nwith some newlines", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption5() { // html-escaped: " hello world" dodgyCaption := `<script>console.log('aha!')</script> hello world` - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("hello world", sanitized) } func (suite *SanitizeTestSuite) TestSanitizeCaption6() { // html-encoded: " hello world" dodgyCaption := `<script>console.log('aha!')</script> hello world` - sanitized := text.SanitizePlaintext(dodgyCaption) + sanitized := text.SanitizeToPlaintext(dodgyCaption) suite.Equal("hello world", sanitized) } @@ -104,24 +104,30 @@ func (suite *SanitizeTestSuite) TestSanitizeCustomCSS() { overflow: hidden; text-overflow: ellipsis; }` - sanitized := text.SanitizePlaintext(customCSS) + sanitized := text.SanitizeToPlaintext(customCSS) suite.Equal(customCSS, sanitized) // should be the same as it was before } func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS1() { // try to break out of pee pee poo poo