X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/196d27cbbc868f82ce9e598b0d7d1a8c460a52c6..e1f66dafca76e69b652b92088632ec2ae0d8e6b7:/t/htmlize.t diff --git a/t/htmlize.t b/t/htmlize.t index 9e2e3ec59..a7e7f8c39 100755 --- a/t/htmlize.t +++ b/t/htmlize.t @@ -1,7 +1,7 @@ #!/usr/bin/perl use warnings; use strict; -use Test::More tests => 16; +use Test::More tests => 26; use Encode; BEGIN { use_ok("IkiWiki"); } @@ -12,17 +12,16 @@ $config{srcdir}=$config{destdir}="/dev/null"; IkiWiki::loadplugins(); IkiWiki::checkconfig(); -is(IkiWiki::htmlize("foo", "mdwn", "foo\n\nbar\n"), "

foo

\n\n

bar

\n", +is(IkiWiki::htmlize("foo", "foo", "mdwn", "foo\n\nbar\n"), "

foo

\n\n

bar

\n", "basic"); -is(IkiWiki::htmlize("foo", "mdwn", readfile("t/test1.mdwn")), +is(IkiWiki::htmlize("foo", "foo", "mdwn", readfile("t/test1.mdwn")), Encode::decode_utf8(qq{

o\nóóóóó

\n}), "utf8; bug #373203"); -ok(IkiWiki::htmlize("foo", "mdwn", readfile("t/test2.mdwn")), +ok(IkiWiki::htmlize("foo", "foo", "mdwn", readfile("t/test2.mdwn")), "this file crashes markdown if it's fed in as decoded utf-8"); -# embedded javascript sanitisation tests sub gotcha { - my $html=IkiWiki::htmlize("foo", "mdwn", shift); + my $html=IkiWiki::htmlize("foo", "foo", "mdwn", shift); return $html =~ /GOTCHA/; } ok(!gotcha(q{click me}), @@ -41,10 +40,31 @@ ok(!gotcha(q{GOTCHA}), "script tag"); +ok(!gotcha(q{
foo
}), + "form action with javascript"); +ok(!gotcha(q{}), + "video poster with javascript"); ok(!gotcha(q{a}), "CSS script test"); +ok(! gotcha(q{}), + "data:text/javascript (jeez!)"); +ok(gotcha(q{}), "data:image/png"); +ok(gotcha(q{}), "data:image/gif"); +ok(gotcha(q{}), "data:image/jpeg"); ok(gotcha(q{

javascript:alert('GOTCHA')

}), "not javascript AFAIK (but perhaps some web browser would like to be perverse and assume it is?)"); ok(gotcha(q{}), "not javascript"); ok(gotcha(q{foo}), "not javascript"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{foo}), + q{foo}, "img with alt tag allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "absolute url allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "relative url allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{bar}), + q{bar}, "class attribute allowed");