hodgestar@933: # -*- coding: utf-8 -*-
hodgestar@933: #
hodgestar@933: # Copyright (C) 2006-2009 Edgewall Software
hodgestar@933: # All rights reserved.
hodgestar@933: #
hodgestar@933: # This software is licensed as described in the file COPYING, which
hodgestar@933: # you should have received as part of this distribution. The terms
hodgestar@933: # are also available at http://genshi.edgewall.org/wiki/License.
hodgestar@933: #
hodgestar@933: # This software consists of voluntary contributions made by many
hodgestar@933: # individuals. For the exact contribution history, see the revision
hodgestar@933: # history and logs, available at http://genshi.edgewall.org/log/.
hodgestar@933: 
hodgestar@933: import doctest
hodgestar@933: import unittest
hodgestar@933: 
hodgestar@933: from genshi.input import HTML, ParseError
hodgestar@933: from genshi.filters.html import HTMLFormFiller, HTMLSanitizer
hodgestar@933: from genshi.template import MarkupTemplate
hodgestar@933: 
hodgestar@933: class HTMLFormFillerTestCase(unittest.TestCase):
hodgestar@933: 
hodgestar@933:     def test_fill_input_text_no_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="text" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller()
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="text" name="foo"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_text_single_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="text" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': 'bar'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="text" name="foo" value="bar"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_text_multi_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="text" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': ['bar']})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="text" name="foo" value="bar"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_hidden_no_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="hidden" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller()
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="hidden" name="foo"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_hidden_single_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="hidden" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': 'bar'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="hidden" name="foo" value="bar"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_hidden_multi_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="hidden" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': ['bar']})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="hidden" name="foo" value="bar"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_textarea_no_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <textarea name="foo"></textarea>
hodgestar@933:         </p></form>""") | HTMLFormFiller()
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <textarea name="foo"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_textarea_single_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <textarea name="foo"></textarea>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': 'bar'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <textarea name="foo">bar</textarea>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_textarea_multi_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <textarea name="foo"></textarea>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': ['bar']})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <textarea name="foo">bar</textarea>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_textarea_multiple(self):
hodgestar@933:         # Ensure that the subsequent textarea doesn't get the data from the
hodgestar@933:         # first
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <textarea name="foo"></textarea>
hodgestar@933:           <textarea name="bar"></textarea>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': 'Some text'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <textarea name="foo">Some text</textarea>
hodgestar@933:           <textarea name="bar"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_textarea_preserve_original(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <textarea name="foo"></textarea>
hodgestar@933:           <textarea name="bar">Original value</textarea>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': 'Some text'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <textarea name="foo">Some text</textarea>
hodgestar@933:           <textarea name="bar">Original value</textarea>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_checkbox_single_value_auto_no_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller()
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_checkbox_single_value_auto(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" />
hodgestar@933:         </p></form>""")
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ''})).render())
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': 'on'})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_checkbox_single_value_defined(self):
hodgestar@933:         html = HTML("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" value="1" />
hodgestar@933:         </p></form>""", encoding='ascii')
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" value="1" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': '1'})).render())
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" value="1"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': '2'})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_checkbox_multi_value_auto(self):
hodgestar@933:         html = HTML("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" />
hodgestar@933:         </p></form>""", encoding='ascii')
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': []})).render())
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ['on']})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_checkbox_multi_value_defined(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" value="1" />
hodgestar@933:         </p></form>""")
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" value="1" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ['1']})).render())
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="checkbox" name="foo" value="1"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ['2']})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_radio_no_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="radio" name="foo" />
hodgestar@933:         </p></form>""") | HTMLFormFiller()
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="radio" name="foo"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_radio_single_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="1" />
hodgestar@933:         </p></form>""")
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="1" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': '1'})).render())
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="1"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': '2'})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_radio_multi_value(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="1" />
hodgestar@933:         </p></form>""")
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="1" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ['1']})).render())
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="1"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ['2']})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_radio_empty_string(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="" />
hodgestar@933:         </p></form>""")
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ''})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_radio_multi_empty_string(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="" />
hodgestar@933:         </p></form>""")
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="radio" name="foo" value="" checked="checked"/>
hodgestar@933:         </p></form>""", (html | HTMLFormFiller(data={'foo': ['']})).render())
hodgestar@933: 
hodgestar@933:     def test_fill_select_no_value_auto(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option>1</option>
hodgestar@933:             <option>2</option>
hodgestar@933:             <option>3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""") | HTMLFormFiller()
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option>1</option>
hodgestar@933:             <option>2</option>
hodgestar@933:             <option>3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_select_no_value_defined(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="1">1</option>
hodgestar@933:             <option value="2">2</option>
hodgestar@933:             <option value="3">3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""") | HTMLFormFiller()
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="1">1</option>
hodgestar@933:             <option value="2">2</option>
hodgestar@933:             <option value="3">3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_select_single_value_auto(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option>1</option>
hodgestar@933:             <option>2</option>
hodgestar@933:             <option>3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': '1'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option selected="selected">1</option>
hodgestar@933:             <option>2</option>
hodgestar@933:             <option>3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_select_single_value_defined(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="1">1</option>
hodgestar@933:             <option value="2">2</option>
hodgestar@933:             <option value="3">3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': '1'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="1" selected="selected">1</option>
hodgestar@933:             <option value="2">2</option>
hodgestar@933:             <option value="3">3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_select_multi_value_auto(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <select name="foo" multiple>
hodgestar@933:             <option>1</option>
hodgestar@933:             <option>2</option>
hodgestar@933:             <option>3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': ['1', '3']})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <select name="foo" multiple="multiple">
hodgestar@933:             <option selected="selected">1</option>
hodgestar@933:             <option>2</option>
hodgestar@933:             <option selected="selected">3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_select_multi_value_defined(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <select name="foo" multiple>
hodgestar@933:             <option value="1">1</option>
hodgestar@933:             <option value="2">2</option>
hodgestar@933:             <option value="3">3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'foo': ['1', '3']})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <select name="foo" multiple="multiple">
hodgestar@933:             <option value="1" selected="selected">1</option>
hodgestar@933:             <option value="2">2</option>
hodgestar@933:             <option value="3" selected="selected">3</option>
hodgestar@933:           </select>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_option_segmented_text(self):
hodgestar@933:         html = MarkupTemplate(u"""<form>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="1">foo $x</option>
hodgestar@933:           </select>
hodgestar@933:         </form>""").generate(x=1) | HTMLFormFiller(data={'foo': '1'})
hodgestar@933:         self.assertEquals(u"""<form>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="1" selected="selected">foo 1</option>
hodgestar@933:           </select>
hodgestar@933:         </form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_option_segmented_text_no_value(self):
hodgestar@933:         html = MarkupTemplate("""<form>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option>foo $x bar</option>
hodgestar@933:           </select>
hodgestar@933:         </form>""").generate(x=1) | HTMLFormFiller(data={'foo': 'foo 1 bar'})
hodgestar@933:         self.assertEquals("""<form>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option selected="selected">foo 1 bar</option>
hodgestar@933:           </select>
hodgestar@933:         </form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_option_unicode_value(self):
hodgestar@933:         html = HTML(u"""<form>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="&ouml;">foo</option>
hodgestar@933:           </select>
hodgestar@933:         </form>""") | HTMLFormFiller(data={'foo': u'ö'})
hodgestar@933:         self.assertEquals(u"""<form>
hodgestar@933:           <select name="foo">
hodgestar@933:             <option value="ö" selected="selected">foo</option>
hodgestar@933:           </select>
hodgestar@933:         </form>""", html.render(encoding=None))
hodgestar@933: 
hodgestar@933:     def test_fill_input_password_disabled(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="password" name="pass" />
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'pass': 'bar'})
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="password" name="pass"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933:     def test_fill_input_password_enabled(self):
hodgestar@933:         html = HTML(u"""<form><p>
hodgestar@933:           <input type="password" name="pass" />
hodgestar@933:         </p></form>""") | HTMLFormFiller(data={'pass': '1234'}, passwords=True)
hodgestar@933:         self.assertEquals("""<form><p>
hodgestar@933:           <input type="password" name="pass" value="1234"/>
hodgestar@933:         </p></form>""", html.render())
hodgestar@933: 
hodgestar@933: 
hodgestar@949: def StyleSanitizer():
hodgestar@949:     safe_attrs = HTMLSanitizer.SAFE_ATTRS | frozenset(['style'])
hodgestar@949:     return HTMLSanitizer(safe_attrs=safe_attrs)
hodgestar@949: 
hodgestar@949: 
hodgestar@933: class HTMLSanitizerTestCase(unittest.TestCase):
hodgestar@933: 
hodgestar@1020:     def assert_parse_error_or_equal(self, expected, exploit,
hodgestar@1020:                                     allow_strip=False):
hodgestar@963:         try:
hodgestar@963:             html = HTML(exploit)
hodgestar@963:         except ParseError:
hodgestar@963:             return
hodgestar@1020:         sanitized_html = (html | HTMLSanitizer()).render()
hodgestar@1020:         if not sanitized_html and allow_strip:
hodgestar@1020:             return
hodgestar@1020:         self.assertEquals(expected, sanitized_html)
hodgestar@963: 
hodgestar@933:     def test_sanitize_unchanged(self):
hodgestar@933:         html = HTML(u'<a href="#">fo<br />o</a>')
hodgestar@933:         self.assertEquals('<a href="#">fo<br/>o</a>',
hodgestar@933:                           (html | HTMLSanitizer()).render())
hodgestar@933:         html = HTML(u'<a href="#with:colon">foo</a>')
hodgestar@933:         self.assertEquals('<a href="#with:colon">foo</a>',
hodgestar@933:                           (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_escape_text(self):
hodgestar@933:         html = HTML(u'<a href="#">fo&amp;</a>')
hodgestar@933:         self.assertEquals('<a href="#">fo&amp;</a>',
hodgestar@933:                           (html | HTMLSanitizer()).render())
hodgestar@933:         html = HTML(u'<a href="#">&lt;foo&gt;</a>')
hodgestar@933:         self.assertEquals('<a href="#">&lt;foo&gt;</a>',
hodgestar@933:                           (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_entityref_text(self):
hodgestar@933:         html = HTML(u'<a href="#">fo&ouml;</a>')
hodgestar@933:         self.assertEquals(u'<a href="#">foö</a>',
hodgestar@933:                           (html | HTMLSanitizer()).render(encoding=None))
hodgestar@933: 
hodgestar@933:     def test_sanitize_escape_attr(self):
hodgestar@933:         html = HTML(u'<div title="&lt;foo&gt;"></div>')
hodgestar@933:         self.assertEquals('<div title="&lt;foo&gt;"/>',
hodgestar@933:                           (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_close_empty_tag(self):
hodgestar@933:         html = HTML(u'<a href="#">fo<br>o</a>')
hodgestar@933:         self.assertEquals('<a href="#">fo<br/>o</a>',
hodgestar@933:                           (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_invalid_entity(self):
hodgestar@933:         html = HTML(u'&junk;')
hodgestar@933:         self.assertEquals('&amp;junk;', (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_remove_script_elem(self):
hodgestar@933:         html = HTML(u'<script>alert("Foo")</script>')
hodgestar@933:         self.assertEquals('', (html | HTMLSanitizer()).render())
hodgestar@933:         html = HTML(u'<SCRIPT SRC="http://example.com/"></SCRIPT>')
hodgestar@933:         self.assertEquals('', (html | HTMLSanitizer()).render())
hodgestar@963:         src = u'<SCR\0IPT>alert("foo")</SCR\0IPT>'
hodgestar@1020:         self.assert_parse_error_or_equal('&lt;SCR\x00IPT&gt;alert("foo")', src,
hodgestar@1020:                                          allow_strip=True)
hodgestar@963:         src = u'<SCRIPT&XYZ SRC="http://example.com/"></SCRIPT>'
hodgestar@963:         self.assert_parse_error_or_equal('&lt;SCRIPT&amp;XYZ; '
hodgestar@1020:                                          'SRC="http://example.com/"&gt;', src,
hodgestar@1020:                                          allow_strip=True)
hodgestar@933: 
hodgestar@933:     def test_sanitize_remove_onclick_attr(self):
hodgestar@933:         html = HTML(u'<div onclick=\'alert("foo")\' />')
hodgestar@933:         self.assertEquals('<div/>', (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_remove_input_password(self):
hodgestar@933:         html = HTML(u'<form><input type="password" /></form>')
hodgestar@933:         self.assertEquals('<form/>', (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_remove_comments(self):
hodgestar@933:         html = HTML(u'''<div><!-- conditional comment crap --></div>''')
hodgestar@933:         self.assertEquals('<div/>', (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_remove_style_scripts(self):
hodgestar@949:         sanitizer = StyleSanitizer()
hodgestar@933:         # Inline style with url() using javascript: scheme
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: url(javascript:alert("foo"))\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         # Inline style with url() using javascript: scheme, using control char
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: url(&#1;javascript:alert("foo"))\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         # Inline style with url() using javascript: scheme, in quotes
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: url("javascript:alert(foo)")\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         # IE expressions in CSS not allowed
hodgestar@933:         html = HTML(u'<DIV STYLE=\'width: expression(alert("foo"));\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<DIV STYLE=\'width: e/**/xpression(alert("foo"));\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: url(javascript:alert("foo"));'
hodgestar@933:                                  'color: #fff\'>')
hodgestar@933:         self.assertEquals('<div style="color: #fff"/>',
hodgestar@933:                           (html | sanitizer).render())
hodgestar@933:         # Inline style with url() using javascript: scheme, using unicode
hodgestar@933:         # escapes
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: \\75rl(javascript:alert("foo"))\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: \\000075rl(javascript:alert("foo"))\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: \\75 rl(javascript:alert("foo"))\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: \\000075 rl(javascript:alert("foo"))\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<DIV STYLE=\'background: \\000075\r\nrl(javascript:alert("foo"))\'>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_remove_style_phishing(self):
hodgestar@949:         sanitizer = StyleSanitizer()
hodgestar@933:         # The position property is not allowed
hodgestar@933:         html = HTML(u'<div style="position:absolute;top:0"></div>')
hodgestar@933:         self.assertEquals('<div style="top:0"/>', (html | sanitizer).render())
hodgestar@933:         # Normal margins get passed through
hodgestar@933:         html = HTML(u'<div style="margin:10px 20px"></div>')
hodgestar@933:         self.assertEquals('<div style="margin:10px 20px"/>',
hodgestar@933:                           (html | sanitizer).render())
hodgestar@933:         # But not negative margins
hodgestar@933:         html = HTML(u'<div style="margin:-1000px 0 0"></div>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<div style="margin-left:-2000px 0 0"></div>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933:         html = HTML(u'<div style="margin-left:1em 1em 1em -4000px"></div>')
hodgestar@933:         self.assertEquals('<div/>', (html | sanitizer).render())
hodgestar@933: 
hodgestar@933:     def test_sanitize_remove_src_javascript(self):
hodgestar@933:         html = HTML(u'<img src=\'javascript:alert("foo")\'>')
hodgestar@933:         self.assertEquals('<img/>', (html | HTMLSanitizer()).render())
hodgestar@933:         # Case-insensitive protocol matching
hodgestar@933:         html = HTML(u'<IMG SRC=\'JaVaScRiPt:alert("foo")\'>')
hodgestar@933:         self.assertEquals('<img/>', (html | HTMLSanitizer()).render())
hodgestar@933:         # Grave accents (not parsed)
hodgestar@963:         src = u'<IMG SRC=`javascript:alert("RSnake says, \'foo\'")`>'
hodgestar@963:         self.assert_parse_error_or_equal('<img/>', src)
hodgestar@933:         # Protocol encoded using UTF-8 numeric entities
hodgestar@933:         html = HTML(u'<IMG SRC=\'&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;'
hodgestar@933:                     '&#112;&#116;&#58;alert("foo")\'>')
hodgestar@933:         self.assertEquals('<img/>', (html | HTMLSanitizer()).render())
hodgestar@933:         # Protocol encoded using UTF-8 numeric entities without a semicolon
hodgestar@933:         # (which is allowed because the max number of digits is used)
hodgestar@933:         html = HTML(u'<IMG SRC=\'&#0000106&#0000097&#0000118&#0000097'
hodgestar@933:                     '&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116'
hodgestar@933:                     '&#0000058alert("foo")\'>')
hodgestar@933:         self.assertEquals('<img/>', (html | HTMLSanitizer()).render())
hodgestar@933:         # Protocol encoded using UTF-8 numeric hex entities without a semicolon
hodgestar@933:         # (which is allowed because the max number of digits is used)
hodgestar@933:         html = HTML(u'<IMG SRC=\'&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69'
hodgestar@933:                     '&#x70&#x74&#x3A;alert("foo")\'>')
hodgestar@933:         self.assertEquals('<img/>', (html | HTMLSanitizer()).render())
hodgestar@933:         # Embedded tab character in protocol
hodgestar@933:         html = HTML(u'<IMG SRC=\'jav\tascript:alert("foo");\'>')
hodgestar@933:         self.assertEquals('<img/>', (html | HTMLSanitizer()).render())
hodgestar@933:         # Embedded tab character in protocol, but encoded this time
hodgestar@933:         html = HTML(u'<IMG SRC=\'jav&#x09;ascript:alert("foo");\'>')
hodgestar@933:         self.assertEquals('<img/>', (html | HTMLSanitizer()).render())
hodgestar@933: 
hodgestar@949:     def test_sanitize_expression(self):
hodgestar@949:         html = HTML(ur'<div style="top:expression(alert())">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_capital_expression(self):
hodgestar@949:         html = HTML(ur'<div style="top:EXPRESSION(alert())">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_url_with_javascript(self):
hodgestar@949:         html = HTML(u'<div style="background-image:url(javascript:alert())">'
hodgestar@949:                     u'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_capital_url_with_javascript(self):
hodgestar@949:         html = HTML(u'<div style="background-image:URL(javascript:alert())">'
hodgestar@949:                     u'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_unicode_escapes(self):
hodgestar@949:         html = HTML(ur'<div style="top:exp\72 ess\000069 on(alert())">'
hodgestar@949:                     ur'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_backslash_without_hex(self):
hodgestar@949:         html = HTML(ur'<div style="top:e\xp\ression(alert())">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949:         html = HTML(ur'<div style="top:e\\xp\\ression(alert())">XSS</div>')
hodgestar@949:         self.assertEqual(r'<div style="top:e\\xp\\ression(alert())">'
hodgestar@949:                          'XSS</div>',
hodgestar@949:                          unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_unsafe_props(self):
hodgestar@949:         html = HTML(u'<div style="POSITION:RELATIVE">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:         html = HTML(u'<div style="behavior:url(test.htc)">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:         html = HTML(u'<div style="-ms-behavior:url(test.htc) url(#obj)">'
hodgestar@949:                     u'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:         html = HTML(u"""<div style="-o-link:'javascript:alert(1)';"""
hodgestar@949:                     u"""-o-link-source:current">XSS</div>""")
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:         html = HTML(u"""<div style="-moz-binding:url(xss.xbl)">XSS</div>""")
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_negative_margin(self):
hodgestar@949:         html = HTML(u'<div style="margin-top:-9999px">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949:         html = HTML(u'<div style="margin:0 -9999px">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_css_hack(self):
hodgestar@949:         html = HTML(u'<div style="*position:static">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:         html = HTML(u'<div style="_margin:-10px">XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_property_name(self):
hodgestar@949:         html = HTML(u'<div style="display:none;border-left-color:red;'
hodgestar@949:                     u'user_defined:1;-moz-user-selct:-moz-all">prop</div>')
hodgestar@949:         self.assertEqual('<div style="display:none; border-left-color:red'
hodgestar@949:                          '">prop</div>',
hodgestar@949:                          unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_unicode_expression(self):
hodgestar@949:         # Fullwidth small letters
hodgestar@949:         html = HTML(u'<div style="top:ｅｘｐｒｅｓｓｉｏｎ(alert())">'
hodgestar@949:                     u'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949:         # Fullwidth capital letters
hodgestar@949:         html = HTML(u'<div style="top:ＥＸＰＲＥＳＳＩＯＮ(alert())">'
hodgestar@949:                     u'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949:         # IPA extensions
hodgestar@949:         html = HTML(u'<div style="top:expʀessɪoɴ(alert())">'
hodgestar@949:                     u'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@949:     def test_sanitize_unicode_url(self):
hodgestar@949:         # IPA extensions
hodgestar@949:         html = HTML(u'<div style="background-image:uʀʟ(javascript:alert())">'
hodgestar@949:                     u'XSS</div>')
hodgestar@949:         self.assertEqual('<div>XSS</div>', unicode(html | StyleSanitizer()))
hodgestar@949: 
hodgestar@933: 
hodgestar@933: def suite():
hodgestar@933:     suite = unittest.TestSuite()
hodgestar@933:     suite.addTest(doctest.DocTestSuite(HTMLFormFiller.__module__))
hodgestar@933:     suite.addTest(unittest.makeSuite(HTMLFormFillerTestCase, 'test'))
hodgestar@933:     suite.addTest(unittest.makeSuite(HTMLSanitizerTestCase, 'test'))
hodgestar@933:     return suite
hodgestar@933: 
hodgestar@933: 
hodgestar@933: if __name__ == '__main__':
hodgestar@933:     unittest.main(defaultTest='suite')