43 lines
1.5 KiB
PHP
43 lines
1.5 KiB
PHP
<?php
|
|
|
|
namespace Tests\Unit;
|
|
|
|
use App\Signature\TemplateSanitizer;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
class TemplateSanitizerTest extends TestCase
|
|
{
|
|
private TemplateSanitizer $s;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
$this->s = new TemplateSanitizer;
|
|
}
|
|
|
|
public function test_retire_scripts_et_balises_actives(): void
|
|
{
|
|
$out = $this->s->clean('<p>A</p><script>alert(1)</script><iframe src="x"></iframe><form><input></form><b>B</b>');
|
|
$this->assertSame('<p>A</p><b>B</b>', $out);
|
|
}
|
|
|
|
public function test_retire_gestionnaires_evenements(): void
|
|
{
|
|
$this->assertSame('<img src="a.png">', $this->s->clean('<img src="a.png" onerror="alert(1)">'));
|
|
$this->assertSame('<a href="https://x">x</a>', $this->s->clean("<a href=\"https://x\" onClick='y()'>x</a>"));
|
|
}
|
|
|
|
public function test_retire_url_javascript_mais_garde_https_mailto_tel(): void
|
|
{
|
|
$this->assertSame('<a>x</a>', $this->s->clean('<a href="javascript:alert(1)">x</a>'));
|
|
$this->assertSame('<a>x</a>', $this->s->clean('<a href=" JaVascript:alert(1)">x</a>'));
|
|
$ok = '<a href="mailto:a@b.fr">m</a><a href="tel:+33400">t</a><img src="https://s/img/l.png">';
|
|
$this->assertSame($ok, $this->s->clean($ok));
|
|
}
|
|
|
|
public function test_conserve_marqueurs_de_template_entre_lignes_de_tableau(): void
|
|
{
|
|
$tpl = '<table><tr><td>{{prenom}}</td></tr>{{#if banniere}}<tr><td>{{{banniere}}}</td></tr>{{/if}}</table>';
|
|
$this->assertSame($tpl, $this->s->clean($tpl));
|
|
}
|
|
}
|