X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/202c4d522f9f83d0e439b3846fb6a90e4eebee59..e6e64bcdaa5e7a9a12f85e1d2a2fe76cb703dc50:/t/htmlize.t?ds=inline diff --git a/t/htmlize.t b/t/htmlize.t index 465004bc1..1569c8dcf 100755 --- a/t/htmlize.t +++ b/t/htmlize.t @@ -1,19 +1,85 @@ #!/usr/bin/perl use warnings; use strict; -use Test::More tests => 4; +use Test::More tests => 31; use Encode; BEGIN { use_ok("IkiWiki"); } -BEGIN { use_ok("IkiWiki::Render"); } # Initialize htmlscrubber plugin -%IkiWiki::config=IkiWiki::defaultconfig(); -$IkiWiki::config{srcdir}=$IkiWiki::config{destdir}="/dev/null"; +%config=IkiWiki::defaultconfig(); +$config{srcdir}=$config{destdir}="/dev/null"; +IkiWiki::loadplugins(); IkiWiki::checkconfig(); -is(IkiWiki::htmlize(".mdwn", "foo\n\nbar\n"), "

foo

\n\n

bar

\n", +is(IkiWiki::htmlize("foo", "foo", "mdwn", "foo\n\nbar\n"), "

foo

\n\n

bar

\n", "basic"); -is(IkiWiki::htmlize(".mdwn", IkiWiki::readfile("t/test1.mdwn")), - Encode::decode_utf8(qq{

o\nóóóóó

\n}), - "utf8; bug #373203"); +my $val=Encode::encode_utf8(IkiWiki::htmlize("foo", "foo", "mdwn", readfile("t/test1.mdwn"))); +ok($val =~/ó/ && $val =~/óóóóó/, "utf8; bug #373203"); +ok(IkiWiki::htmlize("foo", "foo", "mdwn", readfile("t/test2.mdwn")), + "this file crashes markdown if it's fed in as decoded utf-8"); + +sub gotcha { + my $html=IkiWiki::htmlize("foo", "foo", "mdwn", shift); + return $html =~ /GOTCHA/; +} +ok(!gotcha(q{click me}), + "javascript url"); +ok(!gotcha(q{click me}), + "jscript url"); +ok(!gotcha(q{click me}), + "vbscrpt url"); +ok(!gotcha(q{click me}), + "java-tab-script url"); +ok(!gotcha(q{foo}), + "entity-encoded CSS script test"); +ok(!gotcha(q{foo}), + "another entity-encoded CSS script test"); +ok(!gotcha(q{}), + "script tag"); +ok(!gotcha(q{
foo
}), + "form action with javascript"); +ok(!gotcha(q{}), + "video poster with javascript"); +ok(!gotcha(q{a}), + "CSS script test"); +ok(! gotcha(q{}), + "data:text/javascript (jeez!)"); +ok(gotcha(q{}), "data:image/png"); +ok(gotcha(q{}), "data:image/gif"); +ok(gotcha(q{}), "data:image/jpeg"); +ok(gotcha(q{

javascript:alert('GOTCHA')

}), + "not javascript AFAIK (but perhaps some web browser would like to + be perverse and assume it is?)"); +ok(gotcha(q{}), "not javascript"); +ok(gotcha(q{foo}), "not javascript"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{foo}), + q{foo}, "img with alt tag allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "absolute url allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "relative url allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{bar}), + q{bar}, "class attribute allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "simple anchor allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "colon allowed in anchor"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "colon allowed in query string"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "unknown protocol blocked"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "simple relative anchor allowed"); +is(IkiWiki::htmlize("foo", "foo", "mdwn", + q{}), + q{}, "colon in simple relative anchor allowed");