45

2026-09-30 16:27:32 +02:00
commit 310724708f
147 changed files with 21327 additions and 0 deletions
@@ -0,0 +1,42 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Signature\TemplateSanitizer;
+use PHPUnit\Framework\TestCase;
+
+class TemplateSanitizerTest extends TestCase
+{
+    private TemplateSanitizer $s;
+
+    protected function setUp(): void
+    {
+        $this->s = new TemplateSanitizer;
+    }
+
+    public function test_retire_scripts_et_balises_actives(): void
+    {
+        $out = $this->s->clean('<p>A</p><script>alert(1)</script><iframe src="x"></iframe><form><input></form><b>B</b>');
+        $this->assertSame('<p>A</p><b>B</b>', $out);
+    }
+
+    public function test_retire_gestionnaires_evenements(): void
+    {
+        $this->assertSame('<img src="a.png">', $this->s->clean('<img src="a.png" onerror="alert(1)">'));
+        $this->assertSame('<a href="https://x">x</a>', $this->s->clean("<a href=\"https://x\" onClick='y()'>x</a>"));
+    }
+
+    public function test_retire_url_javascript_mais_garde_https_mailto_tel(): void
+    {
+        $this->assertSame('<a>x</a>', $this->s->clean('<a href="javascript:alert(1)">x</a>'));
+        $this->assertSame('<a>x</a>', $this->s->clean('<a href=" JaVa&#115;cript:alert(1)">x</a>'));
+        $ok = '<a href="mailto:a@b.fr">m</a><a href="tel:+33400">t</a><img src="https://s/img/l.png">';
+        $this->assertSame($ok, $this->s->clean($ok));
+    }
+
+    public function test_conserve_marqueurs_de_template_entre_lignes_de_tableau(): void
+    {
+        $tpl = '<table><tr><td>{{prenom}}</td></tr>{{#if banniere}}<tr><td>{{{banniere}}}</td></tr>{{/if}}</table>';
+        $this->assertSame($tpl, $this->s->clean($tpl));
+    }
+}