From 85b59d07b64ad45fe5213a173e5857418620d171 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sat, 22 Sep 2018 03:44:19 +0000
Subject: [PATCH] test: add smoketests for the scrubbing policies
---
test/html_test.exs | 80 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 80 insertions(+)
create mode 100644 test/html_test.exs
diff --git a/test/html_test.exs b/test/html_test.exs
new file mode 100644
index 000000000..f7150759b
--- /dev/null
+++ b/test/html_test.exs
@@ -0,0 +1,80 @@
+defmodule Pleroma.HTMLTest do
+ alias Pleroma.HTML
+ use Pleroma.DataCase
+
+ @html_sample """
+ <b>this is in bold</b>
+ <p>this is a paragraph</p>
+ this is a linebreak<br />
+ this is an image: <img src="http://example.com/image.jpg"><br />
+ <script>alert('hacked')</script>
+ """
+
+ @html_onerror_sample """
+ <img src="http://example.com/image.jpg" onerror="alert('hacked')">
+ """
+
+ describe "StripTags scrubber" do
+ test "works as expected" do
+ expected = """
+ this is in bold
+ this is a paragraph
+ this is a linebreak
+ this is an image:
+ alert('hacked')
+ """
+
+ assert expected == HTML.strip_tags(@html_sample)
+ end
+
+ test "does not allow attribute-based XSS" do
+ expected = "\n"
+
+ assert expected == HTML.strip_tags(@html_onerror_sample)
+ end
+ end
+
+ describe "TwitterText scrubber" do
+ test "normalizes HTML as expected" do
+ expected = """
+ this is in bold
+ <p>this is a paragraph</p>
+ this is a linebreak<br />
+ this is an image: <img src="http://example.com/image.jpg" /><br />
+ alert('hacked')
+ """
+
+ assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.TwitterText)
+ end
+
+ test "does not allow attribute-based XSS" do
+ expected = """
+ <img src="http://example.com/image.jpg" />
+ """
+
+ assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.TwitterText)
+ end
+ end
+
+ describe "default scrubber" do
+ test "normalizes HTML as expected" do
+ expected = """
+ <b>this is in bold</b>
+ <p>this is a paragraph</p>
+ this is a linebreak<br />
+ this is an image: <img src="http://example.com/image.jpg" /><br />
+ alert('hacked')
+ """
+
+ assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.Default)
+ end
+
+ test "does not allow attribute-based XSS" do
+ expected = """
+ <img src="http://example.com/image.jpg" />
+ """
+
+ assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.Default)
+ end
+ end
+end