Mercurial > genshi > mirror

annotate markup/tests/filters.py @ 150:d35688d16831 trunk

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Removed to many classes from the `__all__` list of `markup.template` in [191].
author cmlenz
date Tue, 15 Aug 2006 22:01:01 +0000
parents d1ce85a7f296
children 51d4101f49ca
rev   line source
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
1 # -*- coding: utf-8 -*-
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
2 #
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
3 # Copyright (C) 2006 Edgewall Software
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
4 # All rights reserved.
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
5 #
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
6 # This software is licensed as described in the file COPYING, which
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
7 # you should have received as part of this distribution. The terms
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
8 # are also available at http://markup.edgewall.org/wiki/License.
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
9 #
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
10 # This software consists of voluntary contributions made by many
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
11 # individuals. For the exact contribution history, see the revision
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
12 # history and logs, available at http://markup.edgewall.org/log/.
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
13
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
14 import doctest
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
15 import unittest
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
16
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
17 from markup.core import Stream
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
18 from markup.input import HTML, ParseError
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
19 from markup.filters import HTMLSanitizer
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
20
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
21
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
22 class HTMLSanitizerTestCase(unittest.TestCase):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
23
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
24 def test_sanitize_unchanged(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
25 html = HTML('<a href="#">fo<br />o</a>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
26 self.assertEquals(u'<a href="#">fo<br/>o</a>',
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
27 unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
28
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
29 def test_sanitize_escape_text(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
30 html = HTML('<a href="#">fo&amp;</a>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
31 self.assertEquals(u'<a href="#">fo&amp;</a>',
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
32 unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
33 html = HTML('<a href="#">&lt;foo&gt;</a>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
34 self.assertEquals(u'<a href="#">&lt;foo&gt;</a>',
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
35 unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
36
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
37 def test_sanitize_entityref_text(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
38 html = HTML('<a href="#">fo&ouml;</a>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
39 self.assertEquals(u'<a href="#">foö</a>',
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
40 unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
41
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
42 def test_sanitize_escape_attr(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
43 html = HTML('<div title="&lt;foo&gt;"></div>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
44 self.assertEquals(u'<div title="&lt;foo&gt;"/>',
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
45 unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
46
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
47 def test_sanitize_close_empty_tag(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
48 html = HTML('<a href="#">fo<br>o</a>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
49 self.assertEquals(u'<a href="#">fo<br/>o</a>',
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
50 unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
51
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
52 def test_sanitize_invalid_entity(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
53 html = HTML('&junk;')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
54 self.assertEquals('&amp;junk;', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
55
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
56 def test_sanitize_remove_script_elem(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
57 html = HTML('<script>alert("Foo")</script>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
58 self.assertEquals(u'', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
59 html = HTML('<SCRIPT SRC="http://example.com/"></SCRIPT>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
60 self.assertEquals(u'', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
61 self.assertRaises(ParseError, HTML, '<SCR\0IPT>alert("foo")</SCR\0IPT>')
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
62 self.assertRaises(ParseError, HTML,
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
63 '<SCRIPT&XYZ SRC="http://example.com/"></SCRIPT>')
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
64
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
65 def test_sanitize_remove_onclick_attr(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
66 html = HTML('<div onclick=\'alert("foo")\' />')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
67 self.assertEquals(u'<div/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
68
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
69 def test_sanitize_remove_style_scripts(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
70 # Inline style with url() using javascript: scheme
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
71 html = HTML('<DIV STYLE=\'background: url(javascript:alert("foo"))\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
72 self.assertEquals(u'<div/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
73 # Inline style with url() using javascript: scheme, using control char
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
74 html = HTML('<DIV STYLE=\'background: url(&#1;javascript:alert("foo"))\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
75 self.assertEquals(u'<div/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
76 # Inline style with url() using javascript: scheme, in quotes
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
77 html = HTML('<DIV STYLE=\'background: url("javascript:alert(foo)")\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
78 self.assertEquals(u'<div/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
79 # IE expressions in CSS not allowed
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
80 html = HTML('<DIV STYLE=\'width: expression(alert("foo"));\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
81 self.assertEquals(u'<div/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
82 html = HTML('<DIV STYLE=\'background: url(javascript:alert("foo"));'
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
83 'color: #fff\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
84 self.assertEquals(u'<div style="color: #fff"/>',
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
85 unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
86
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
87 def test_sanitize_remove_src_javascript(self):
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
88 html = HTML('<img src=\'javascript:alert("foo")\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
89 self.assertEquals(u'<img/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
90 # Case-insensitive protocol matching
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
91 html = HTML('<IMG SRC=\'JaVaScRiPt:alert("foo")\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
92 self.assertEquals(u'<img/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
93 # Grave accents (not parsed)
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
94 self.assertRaises(ParseError, HTML,
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
95 '<IMG SRC=`javascript:alert("RSnake says, \'foo\'")`>')
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
96 # Protocol encoded using UTF-8 numeric entities
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
97 html = HTML('<IMG SRC=\'&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;'
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
98 '&#112;&#116;&#58;alert("foo")\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
99 self.assertEquals(u'<img/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
100 # Protocol encoded using UTF-8 numeric entities without a semicolon
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
101 # (which is allowed because the max number of digits is used)
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
102 html = HTML('<IMG SRC=\'&#0000106&#0000097&#0000118&#0000097'
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
103 '&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116'
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
104 '&#0000058alert("foo")\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
105 self.assertEquals(u'<img/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
106 # Protocol encoded using UTF-8 numeric hex entities without a semicolon
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
107 # (which is allowed because the max number of digits is used)
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
108 html = HTML('<IMG SRC=\'&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69'
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
109 '&#x70&#x74&#x3A;alert("foo")\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
110 self.assertEquals(u'<img/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
111 # Embedded tab character in protocol
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
112 html = HTML('<IMG SRC=\'jav\tascript:alert("foo");\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
113 self.assertEquals(u'<img/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
114 # Embedded tab character in protocol, but encoded this time
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
115 html = HTML('<IMG SRC=\'jav&#x09;ascript:alert("foo");\'>')
144
d1ce85a7f296 * Coalesce adjacent text events that the parsers would produce when text crossed the buffer boundaries. Fixes #26.
cmlenz
parents: 115
diff changeset
116 self.assertEquals(u'<img/>', unicode(html.filter(HTMLSanitizer())))
113
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
117
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
118
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
119 def suite():
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
120 suite = unittest.TestSuite()
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
121 suite.addTest(unittest.makeSuite(HTMLSanitizerTestCase, 'test'))
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
122 return suite
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
123
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
124 if __name__ == '__main__':
d10fbba1d5e0 Removed the `sanitize()` method from the `Markup` class, and migrate the existing unit tests to `markup.tests.filters`. Provide a `Stream.filter()` method instead which can be used to conveniently apply a filter to a stream.
cmlenz
parents:
diff changeset
125 unittest.main(defaultTest='suite')
Copyright (C) 2012-2017 Edgewall Software