Source Code Cross Referenced for SafeHtmlTest.java in  » Forum » JForum-2.1.8 » net » jforum » util » Java Source Code / Java DocumentationJava Source Code and Java Documentation

01:        package net.jforum.util;
02:
03:        import junit.framework.TestCase;
04:        import net.jforum.TestCaseUtils;
05:        import net.jforum.util.preferences.ConfigKeys;
06:        import net.jforum.util.preferences.SystemGlobals;
07:
08:        /**
09:         * @author Rafael Steil
10:         * @version $Id: SafeHtmlTest.java,v 1.12 2007/09/19 14:08:56 rafaelsteil Exp $
11:         */
12:        public class SafeHtmlTest extends TestCase {
13:            private static final String WELCOME_TAGS = "a, b, i, u, img";
14:            private String input;
15:            private String expected;
16:
17:            /** 
18:             * @see junit.framework.TestCase#setUp()
19:             */
20:            protected void setUp() throws Exception {
21:                TestCaseUtils.loadEnvironment();
22:
23:                StringBuffer sb = new StringBuffer(512);
24:                sb.append("<a href='http://somelink'>Some Link</a>");
25:                sb.append("bla <b>bla</b> <pre>code code</pre>");
26:                sb.append("<script>document.location = 'xxx';</script>");
27:                sb
28:                        .append("<img src='http://imgPath' onLoad='window.close();'>");
29:                sb.append("<a href='javascript:alert(bleh)'>xxxx</a>");
30:                sb.append("<img src='javascript:alert(bloh)'>");
31:                sb
32:                        .append("<img src=\"&#106ava&#115cript&#58aler&#116&#40&#39Oops&#39&#41&#59\">");
33:                sb.append("\"> TTTTT <");
34:                sb
35:                        .append("<img src='http://some.image' onLoad=\"javascript:alert('boo')\">");
36:                sb.append("<b>heeelooo, nurse</b>");
37:                sb.append("<b style='some style'>1, 2, 3</b>");
38:                this .input = sb.toString();
39:
40:                sb = new StringBuffer(512);
41:                sb.append("<a href='http://somelink'>Some Link</a>");
42:                sb.append("bla <b>bla</b> &lt;pre&gt;code code&lt;/pre&gt;");
43:                sb
44:                        .append("&lt;script&gt;document.location = 'xxx';&lt;/script&gt;");
45:                sb.append("<img src='http://imgPath' >");
46:                sb.append("<a >xxxx</a>");
47:                sb.append("<img >");
48:                sb.append("<img >");
49:                sb.append("&quot;&gt; TTTTT &lt;");
50:                sb.append("<img src='http://some.image' >");
51:                sb.append("<b>heeelooo, nurse</b>");
52:                sb.append("<b >1, 2, 3</b>");
53:                this .expected = sb.toString();
54:            }
55:
56:            public void testJavascriptInsideURLTagExpectItToBeRemoved() {
57:                String input = "<a class=\"snap_shots\" rel=\"nofollow\" target=\"_new\" onmouseover=\"javascript:alert('test2');\" href=\"before\">test</a>";
58:                String expected = "<a class=\"snap_shots\" rel=\"nofollow\" target=\"_new\"  >test</a>";
59:
60:                String result = new SafeHtml()
61:                        .ensureAllAttributesAreSafe(input);
62:
63:                assertEquals(expected, result);
64:            }
65:
66:            public void testJavascriptInsideImageTagExpectItToBeRemoved() {
67:                String input = "<img border=\"0\" onmouseover=\"javascript:alert('buuuh!!!');\"\"\" src=\"javascript:alert('hi from an alert!');\"/>";
68:                String expected = "<img border=\"0\" \"\" />";
69:
70:                String result = new SafeHtml()
71:                        .ensureAllAttributesAreSafe(input);
72:
73:                assertEquals(expected, result);
74:            }
75:
76:            public void testIframe() {
77:                String input = "<iframe src='http://www.google.com' onload='javascript:parent.document.body.style.display=\'none\'; alert(\'where is the forum?\'); ' style='display:none;'></iframe>";
78:                String output = "&lt;iframe src='http://www.google.com' onload='javascript:parent.document.body.style.display=\'none\'; alert(\'where is the forum?\'); ' style='display:none;'&gt;&lt;/iframe&gt;";
79:
80:                SystemGlobals.setValue(ConfigKeys.HTML_TAGS_WELCOME,
81:                        WELCOME_TAGS);
82:                assertEquals(output, new SafeHtml().makeSafe(input));
83:            }
84:
85:            public void testMakeSafe() throws Exception {
86:                SystemGlobals.setValue(ConfigKeys.HTML_TAGS_WELCOME,
87:                        WELCOME_TAGS);
88:                assertEquals(this .expected, new SafeHtml().makeSafe(this.input));
89:            }
90:        }