cmlenz@1: # -*- coding: utf-8 -*-
cmlenz@1: #
cmlenz@1: # Copyright (C) 2006 Christopher Lenz
cmlenz@1: # All rights reserved.
cmlenz@1: #
cmlenz@1: # This software is licensed as described in the file COPYING, which
cmlenz@1: # you should have received as part of this distribution. The terms
cmlenz@1: # are also available at http://trac.edgewall.com/license.html.
cmlenz@1: #
cmlenz@1: # This software consists of voluntary contributions made by many
cmlenz@1: # individuals. For the exact contribution history, see the revision
cmlenz@1: # history and logs, available at http://projects.edgewall.com/trac/.
cmlenz@1: 
cmlenz@1: import doctest
cmlenz@1: import unittest
cmlenz@1: 
cmlenz@18: from markup.core import *
cmlenz@21: from markup.input import ParseError
cmlenz@1: 
cmlenz@1: 
cmlenz@1: class MarkupTestCase(unittest.TestCase):
cmlenz@1: 
cmlenz@1:     def test_escape(self):
cmlenz@1:         markup = escape('<b>"&"</b>')
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('&lt;b&gt;&#34;&amp;&#34;&lt;/b&gt;', markup)
cmlenz@1: 
cmlenz@1:     def test_escape_noquotes(self):
cmlenz@1:         markup = escape('<b>"&"</b>', quotes=False)
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('&lt;b&gt;"&amp;"&lt;/b&gt;', markup)
cmlenz@1: 
cmlenz@1:     def test_unescape_markup(self):
cmlenz@1:         string = '<b>"&"</b>'
cmlenz@1:         markup = Markup.escape(string)
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals(string, unescape(markup))
cmlenz@1: 
cmlenz@1:     def test_add_str(self):
cmlenz@1:         markup = Markup('<b>foo</b>') + '<br/>'
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('<b>foo</b>&lt;br/&gt;', markup)
cmlenz@1: 
cmlenz@1:     def test_add_markup(self):
cmlenz@1:         markup = Markup('<b>foo</b>') + Markup('<br/>')
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('<b>foo</b><br/>', markup)
cmlenz@1: 
cmlenz@1:     def test_add_reverse(self):
cmlenz@1:         markup = 'foo' + Markup('<b>bar</b>')
cmlenz@1:         assert isinstance(markup, unicode)
cmlenz@1:         self.assertEquals('foo<b>bar</b>', markup)
cmlenz@1: 
cmlenz@1:     def test_mod(self):
cmlenz@1:         markup = Markup('<b>%s</b>') % '&'
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('<b>&amp;</b>', markup)
cmlenz@1: 
cmlenz@1:     def test_mod_multi(self):
cmlenz@1:         markup = Markup('<b>%s</b> %s') % ('&', 'boo')
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('<b>&amp;</b> boo', markup)
cmlenz@1: 
cmlenz@1:     def test_mul(self):
cmlenz@1:         markup = Markup('<b>foo</b>') * 2
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('<b>foo</b><b>foo</b>', markup)
cmlenz@1: 
cmlenz@1:     def test_join(self):
cmlenz@1:         markup = Markup('<br />').join(['foo', '<bar />', Markup('<baz />')])
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('foo<br />&lt;bar /&gt;<br /><baz />', markup)
cmlenz@1: 
cmlenz@1:     def test_stripentities_all(self):
cmlenz@1:         markup = Markup('&amp; &#106;').stripentities()
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('& j', markup)
cmlenz@1: 
cmlenz@1:     def test_stripentities_keepxml(self):
cmlenz@1:         markup = Markup('<a href="#">fo<br />o</a>').striptags()
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('foo', markup)
cmlenz@1: 
cmlenz@1:     def test_striptags_empty(self):
cmlenz@1:         markup = Markup('<br />').striptags()
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('', markup)
cmlenz@1: 
cmlenz@1:     def test_striptags_mid(self):
cmlenz@1:         markup = Markup('<a href="#">fo<br />o</a>').striptags()
cmlenz@1:         assert isinstance(markup, Markup)
cmlenz@1:         self.assertEquals('foo', markup)
cmlenz@1: 
cmlenz@1:     def test_sanitize_unchanged(self):
cmlenz@1:         markup = Markup('<a href="#">fo<br />o</a>')
cmlenz@1:         self.assertEquals('<a href="#">fo<br/>o</a>', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_escape_text(self):
cmlenz@1:         markup = Markup('<a href="#">fo&amp;</a>')
cmlenz@1:         self.assertEquals('<a href="#">fo&amp;</a>', str(markup.sanitize()))
cmlenz@1:         markup = Markup('<a href="#">&lt;foo&gt;</a>')
cmlenz@1:         self.assertEquals('<a href="#">&lt;foo&gt;</a>', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_entityref_text(self):
cmlenz@1:         markup = Markup('<a href="#">fo&ouml;</a>')
cmlenz@1:         self.assertEquals(u'<a href="#">foö</a>', unicode(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_escape_attr(self):
cmlenz@1:         markup = Markup('<div title="&lt;foo&gt;"></div>')
cmlenz@1:         self.assertEquals('<div title="&lt;foo&gt;"/>', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_close_empty_tag(self):
cmlenz@1:         markup = Markup('<a href="#">fo<br>o</a>')
cmlenz@1:         self.assertEquals('<a href="#">fo<br/>o</a>', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_invalid_entity(self):
cmlenz@1:         markup = Markup('&junk;')
cmlenz@1:         self.assertEquals('&amp;junk;', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_remove_script_elem(self):
cmlenz@1:         markup = Markup('<script>alert("Foo")</script>')
cmlenz@1:         self.assertEquals('', str(markup.sanitize()))
cmlenz@1:         markup = Markup('<SCRIPT SRC="http://example.com/"></SCRIPT>')
cmlenz@1:         self.assertEquals('', str(markup.sanitize()))
cmlenz@1:         markup = Markup('<SCR\0IPT>alert("foo")</SCR\0IPT>')
cmlenz@21:         self.assertRaises(ParseError, markup.sanitize().render)
cmlenz@1:         markup = Markup('<SCRIPT&XYZ SRC="http://example.com/"></SCRIPT>')
cmlenz@21:         self.assertRaises(ParseError, markup.sanitize().render)
cmlenz@1: 
cmlenz@1:     def test_sanitize_remove_onclick_attr(self):
cmlenz@1:         markup = Markup('<div onclick=\'alert("foo")\' />')
cmlenz@1:         self.assertEquals('<div/>', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_remove_style_scripts(self):
cmlenz@1:         # Inline style with url() using javascript: scheme
cmlenz@1:         markup = Markup('<DIV STYLE=\'background: url(javascript:alert("foo"))\'>')
cmlenz@1:         self.assertEquals('<div/>', str(markup.sanitize()))
cmlenz@1:         # Inline style with url() using javascript: scheme, using control char
cmlenz@1:         markup = Markup('<DIV STYLE=\'background: url(&#1;javascript:alert("foo"))\'>')
cmlenz@1:         self.assertEquals('<div/>', str(markup.sanitize()))
cmlenz@1:         # Inline style with url() using javascript: scheme, in quotes
cmlenz@1:         markup = Markup('<DIV STYLE=\'background: url("javascript:alert(foo)")\'>')
cmlenz@1:         self.assertEquals('<div/>', str(markup.sanitize()))
cmlenz@1:         # IE expressions in CSS not allowed
cmlenz@1:         markup = Markup('<DIV STYLE=\'width: expression(alert("foo"));\'>')
cmlenz@1:         self.assertEquals('<div/>', str(markup.sanitize()))
cmlenz@1:         markup = Markup('<DIV STYLE=\'background: url(javascript:alert("foo"));'
cmlenz@1:                                      'color: #fff\'>')
cmlenz@1:         self.assertEquals('<div style="color: #fff"/>', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1:     def test_sanitize_remove_src_javascript(self):
cmlenz@1:         markup = Markup('<img src=\'javascript:alert("foo")\'>')
cmlenz@1:         self.assertEquals('<img/>', str(markup.sanitize()))
cmlenz@1:         # Case-insensitive protocol matching
cmlenz@1:         markup = Markup('<IMG SRC=\'JaVaScRiPt:alert("foo")\'>')
cmlenz@1:         self.assertEquals('<img/>', str(markup.sanitize()))
cmlenz@1:         # Grave accents (not parsed)
cmlenz@1:         markup = Markup('<IMG SRC=`javascript:alert("RSnake says, \'foo\'")`>')
cmlenz@21:         self.assertRaises(ParseError, markup.sanitize().render)
cmlenz@1:         # Protocol encoded using UTF-8 numeric entities
cmlenz@1:         markup = Markup('<IMG SRC=\'&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;'
cmlenz@1:                         '&#112;&#116;&#58;alert("foo")\'>')
cmlenz@1:         self.assertEquals('<img/>', str(markup.sanitize()))
cmlenz@1:         # Protocol encoded using UTF-8 numeric entities without a semicolon
cmlenz@1:         # (which is allowed because the max number of digits is used)
cmlenz@1:         markup = Markup('<IMG SRC=\'&#0000106&#0000097&#0000118&#0000097'
cmlenz@1:                         '&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116'
cmlenz@1:                         '&#0000058alert("foo")\'>')
cmlenz@1:         self.assertEquals('<img/>', str(markup.sanitize()))
cmlenz@1:         # Protocol encoded using UTF-8 numeric hex entities without a semicolon
cmlenz@1:         # (which is allowed because the max number of digits is used)
cmlenz@1:         markup = Markup('<IMG SRC=\'&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69'
cmlenz@1:                         '&#x70&#x74&#x3A;alert("foo")\'>')
cmlenz@1:         self.assertEquals('<img/>', str(markup.sanitize()))
cmlenz@1:         # Embedded tab character in protocol
cmlenz@1:         markup = Markup('<IMG SRC=\'jav\tascript:alert("foo");\'>')
cmlenz@1:         self.assertEquals('<img/>', str(markup.sanitize()))
cmlenz@1:         # Embedded tab character in protocol, but encoded this time
cmlenz@1:         markup = Markup('<IMG SRC=\'jav&#x09;ascript:alert("foo");\'>')
cmlenz@1:         self.assertEquals('<img/>', str(markup.sanitize()))
cmlenz@1: 
cmlenz@1: 
cmlenz@1: def suite():
cmlenz@1:     suite = unittest.TestSuite()
cmlenz@1:     suite.addTest(unittest.makeSuite(MarkupTestCase, 'test'))
cmlenz@18:     suite.addTest(doctest.DocTestSuite(Markup.__module__))
cmlenz@1:     return suite
cmlenz@1: 
cmlenz@1: if __name__ == '__main__':
cmlenz@1:     unittest.main(defaultTest='suite')