first commit

This commit is contained in:
aschwarz
2023-02-27 10:20:09 +01:00
commit 09ee4a8728
2309 changed files with 449255 additions and 0 deletions

View File

@ -0,0 +1,8 @@
--INI--
HTML.AllowedElements = b,i,p,a
HTML.AllowedAttributes = a.href,*.id
--HTML--
<p>Par.</p>
<p>Para<a href="http://google.com/">gr</a>aph</p>
Text<b>Bol<i>d</i></b>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,8 @@
--INI--
HTML.AllowedElements = b,i,p,a
HTML.AllowedAttributes = a.href,*.id
--HTML--
<span>Not allowed</span><a class="mef" id="foobar">Remove id too!</a>
--EXPECT--
Not allowed<a>Remove id too!</a>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--HTML--
<b>basic</b>
--EXPECT--
<b>basic</b>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
HTML.ForbiddenElements = b
HTML.ForbiddenAttributes = a@href
--HTML--
<p>foo</p>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,8 @@
--INI--
HTML.ForbiddenElements = b
HTML.ForbiddenAttributes = a@href
--HTML--
<b>Foo<a href="bar">bar</a></b>
--EXPECT--
Foo<a>bar</a>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--INI--
CSS.AllowedProperties = color,background-color
--HTML--
<div style="color:#f00;background-color:#ded;">red</div>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
--INI--
CSS.AllowedProperties = color,background-color
--HTML--
<div style="color:#f00;border:1px solid #000">red</div>
--EXPECT--
<div style="color:#f00;">red</div>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
URI.Disable = true
--HTML--
<img src="foobar" />
--EXPECT--
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
HTML.SafeObject = true
Output.FlashCompat = true
--HTML--
<object width="425" height="350" data="http://www.youtube.com/v/BdU--T8rLns" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/BdU--T8rLns" /><param name="wmode" value="window" /></object>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
--HTML--
--EXPECT--
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--INI--
URI.AllowedSchemes = file
--HTML--
<a href="file:///foo">foo</a>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--HTML--
<span id="moon">foobar</span>
--EXPECT--
<span>foobar</span>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
Attr.EnableID = true
--HTML--
<span id="moon">foobar</span>
<img id="folly" src="folly.png" alt="Omigosh!" />
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,8 @@
--INI--
Attr.EnableID = true
Core.LexerImpl = DirectLex
--HTML--
<img src="img_11775.jpg" alt="[Img #11775]" id="EMBEDDED_IMG_11775" >
--EXPECT--
<img src="img_11775.jpg" alt="[Img #11775]" id="EMBEDDED_IMG_11775" />
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,11 @@
--INI--
Attr.EnableID = true
--HTML--
<a name="foo" id="foo">Test</a>
<a name="foo">Test2</a>
<a name="bar" id="baz">Test3</a>
--EXPECT--
<a name="foo" id="foo">Test</a>
<a>Test2</a>
<a name="bar" id="baz">Test3</a>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--HTML--
<i><ul></ul></i>
--EXPECT--
<i></i><i></i>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--HTML--
<a href="foo.html"><h1>Foobar</h1></a>
--EXPECT--
<a href="foo.html"></a><h1><a href="foo.html">Foobar</a></h1><a href="foo.html"></a>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
ERROR: Cannot allow ul/ol without allowing li
--INI--
HTML.AllowedElements = ul
--HTML--
<ul><li>foo</li></ul>
--EXPECT--
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
--INI--
Core.LexerImpl = DirectLex
--HTML--
<ul><li>Sublist 1</li><ul><li>Bullet</li></ul><li>Sublist 2</li><ol><li>Billet</li></ol></ul>
--EXPECT--
<ul><li>Sublist 1<ul><li>Bullet</li></ul></li><li>Sublist 2<ol><li>Billet</li></ol></li></ul>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,13 @@
--SKIPIF--
return !function_exists('hash_hmac');
--INI--
URI.Munge = "/redirect?s=%s&t=%t&r=%r&n=%n&m=%m&p=%p"
URI.MungeSecretKey = "foo"
URI.MungeResources = true
--HTML--
<a href="http://example.com">Link</a>
<img src="http://example.com" style="background-image:url(http://example.com);" alt="example.com" />
--EXPECT--
<a href="/redirect?s=http%3A%2F%2Fexample.com&amp;t=c763c4a30204eee8470a3292e0f0cd91a639654d039d45f1495a50207847e954&amp;r=&amp;n=a&amp;m=href&amp;p=">Link</a>
<img src="/redirect?s=http%3A%2F%2Fexample.com&amp;t=c763c4a30204eee8470a3292e0f0cd91a639654d039d45f1495a50207847e954&amp;r=1&amp;n=img&amp;m=src&amp;p=" style="background-image:url(&quot;/redirect?s=http%3A%2F%2Fexample.com&amp;t=c763c4a30204eee8470a3292e0f0cd91a639654d039d45f1495a50207847e954&amp;r=1&amp;n=img&amp;m=style&amp;p=background-image&quot;);" alt="example.com" />
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,52 @@
--INI--
URI.Munge = "/r/%s"
URI.AllowedSchemes = http,ftp,file
--HTML--
<a href="google.com">foo</a>
<a href="/google.com">foo</a>
<a href="//google.com">foo</a>
<a href="///google.com">foo</a>
<a href="////google.com">foo</a>
<a href="http:google.com">foo</a>
<a href="http:/google.com">foo</a>
<a href="http://google.com">foo</a>
<a href="http:///google.com">foo</a>
<a href="http:////google.com">foo</a>
<a href="ftp:google.com">foo</a>
<a href="ftp:/google.com">foo</a>
<a href="ftp://google.com">foo</a>
<a href="ftp:///google.com">foo</a>
<a href="ftp:////google.com">foo</a>
<a href="file:google.com">foo</a>
<a href="file:/google.com">foo</a>
<a href="file://google.com">foo</a>
<a href="file:///google.com">foo</a>
<a href="file:////google.com">foo</a>
--EXPECT--
<a href="google.com">foo</a>
<a href="/google.com">foo</a>
<a href="/r/%2F%2Fgoogle.com">foo</a>
<a href="/google.com">foo</a>
<a>foo</a>
<a href="google.com">foo</a>
<a href="/google.com">foo</a>
<a href="/r/http%3A%2F%2Fgoogle.com">foo</a>
<a href="/google.com">foo</a>
<a>foo</a>
<a>foo</a>
<a>foo</a>
<a href="/r/ftp%3A%2F%2Fgoogle.com">foo</a>
<a>foo</a>
<a>foo</a>
<a href="file:google.com">foo</a>
<a href="file:/google.com">foo</a>
<a href="file://google.com">foo</a>
<a href="file:///google.com">foo</a>
<a href="file:////google.com">foo</a>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
Attr.EnableID = true
HTML.Doctype = "XHTML 1.0 Strict"
--HTML--
<a name="asdf"></a>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,8 @@
--INI--
HTML.SafeIframe = true
URI.SafeIframeRegexp = "%^http://maps.google.com/%"
--HTML--
<iframe width="425" height="350" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="http://maps.google.com/?ie=UTF8&amp;ll=37.0625,-95.677068&amp;spn=24.455808,37.353516&amp;z=4&amp;output=embed"></iframe>
--EXPECT--
<iframe width="425" height="350" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="http://maps.google.com/?ie=UTF8&amp;ll=37.0625,-95.677068&amp;spn=24.455808,37.353516&amp;z=4&amp;output=embed"></iframe>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
--INI--
HTML.SafeIframe = true
--HTML--
<iframe src="http://www.example.com/"></iframe>
--EXPECT--
<iframe></iframe>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,8 @@
--INI--
HTML.SafeIframe = true
URI.SafeIframeRegexp = "%^http://www.youtube.com/embed/%"
--HTML--
<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0" allowfullscreen></iframe>
--EXPECT--
<iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RVtEQxH7PWA" frameborder="0"></iframe>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,14 @@
--INI--
HTML.SafeIframe = true
URI.SafeIframeRegexp = "%(^http://www.example.com/|^https?://dev.example.com/)%"
--HTML--
<iframe src="http://www.example.com/"></iframe>
<iframe src="http://malicious.host.com/?http://www.example.com/"></iframe>
<iframe src="http://dev.example.com/"></iframe>
<iframe src="https://dev.example.com/"></iframe>
--EXPECT--
<iframe src="http://www.example.com/"></iframe>
<iframe></iframe>
<iframe src="http://dev.example.com/"></iframe>
<iframe src="https://dev.example.com/"></iframe>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,12 @@
--SKIPIF--
return !function_exists('hash_hmac');
--INI--
HTML.SafeObject = true
HTML.SafeEmbed = true
URI.Munge = "/redirect.php?url=%s&check=%t"
URI.MungeSecretKey = "foo"
--HTML--
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
--EXPECT--
<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&amp;hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&amp;hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&amp;hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,8 @@
--INI--
HTML.SafeObject = true
HTML.SafeEmbed = true
--HTML--
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en"></param><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&hl=en" type="application/x-shockwave-flash" width="425" height="344"></embed></object>
--EXPECT--
<object width="425" height="344" data="http://www.youtube.com/v/Oq3FV_zdyy0&amp;hl=en" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/v/Oq3FV_zdyy0&amp;hl=en" /><embed src="http://www.youtube.com/v/Oq3FV_zdyy0&amp;hl=en" type="application/x-shockwave-flash" width="425" height="344" allowscriptaccess="never" allownetworking="internal" /></object>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,9 @@
--INI--
HTML.Trusted = true
--HTML--
<script type="text/javascript">alert("<This is compatible with XHTML>");</script>
--EXPECT--
<script type="text/javascript"><!--//--><![CDATA[//><!--
alert("<This is compatible with XHTML>");
//--><!]]></script>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,11 @@
--INI--
HTML.Trusted = true
--HTML--
<script type="text/javascript"><![CDATA[
alert("<This is compatible with XHTML>");
]]></script>
--EXPECT--
<script type="text/javascript"><!--//--><![CDATA[//><!--
alert("<This is compatible with XHTML>");
//--><!]]></script>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,11 @@
--INI--
HTML.Trusted = true
--HTML--
<script type="text/javascript"><!--
alert("<This is compatible with XHTML>");
//--></script>
--EXPECT--
<script type="text/javascript"><!--//--><![CDATA[//><!--
alert("<This is compatible with XHTML>");
//--><!]]></script>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,11 @@
--INI--
HTML.Trusted = true
--HTML--
<script type="text/javascript"><![CDATA[
alert("<This is compatible with XHTML>");
//]]></script>
--EXPECT--
<script type="text/javascript"><!--//--><![CDATA[//><!--
alert("<This is compatible with XHTML>");
//--><!]]></script>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,11 @@
--INI--
HTML.Trusted = true
--HTML--
<script type="text/javascript"><!--//--><![CDATA[//><!--
alert("<This is compatible with XHTML>");
//--><!]]></script>
--EXPECT--
<script type="text/javascript"><!--//--><![CDATA[//><!--
alert("<This is compatible with XHTML>");
//--><!]]></script>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,12 @@
--SKIPIF--
return !function_exists('hash_hmac');
--INI--
URI.Munge = "/redirect.php?url=%s&check=%t"
URI.MungeSecretKey = "foo"
--HTML--
<a href="http://localhost">foo</a>
<img src="http://localhost" alt="local" />
--EXPECT--
<a href="/redirect.php?url=http%3A%2F%2Flocalhost&amp;check=c0efad89696082f5cb925d28636b0f4260f346391c92c70c8e9eba72591c2a73">foo</a>
<img src="http://localhost" alt="local" />
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,8 @@
--SKIPIF--
if (!HTMLPurifier_Encoder::iconvAvailable()) return true;
--INI--
Core.Encoding = "Shift_JIS"
Core.EscapeNonASCIICharacters = true
--HTML--
<b style="font-family:'&#165;';">111</b>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,9 @@
--SKIPIF--
if (!HTMLPurifier_Encoder::iconvAvailable()) return true;
--INI--
Core.Encoding = Shift_JIS
--HTML--
<b style="font-family:'&#165;';">111</b>
--EXPECT--
<b style="font-family:'';">111</b>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
--INI--
HTML.Doctype = "XHTML 1.0 Strict"
--HTML--
<blockquote>Illegal <b>contents</b></blockquote>
--EXPECT--
<blockquote><p>Illegal <b>contents</b></p></blockquote>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
--INI--
HTML.Strict = true
--HTML--
<blockquote>Illegal contents</blockquote>
--EXPECT--
<blockquote><p>Illegal contents</p></blockquote>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
--INI--
HTML.Strict = true
--HTML--
<u>Illegal underline</u>
--EXPECT--
<span style="text-decoration:underline;">Illegal underline</span>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
Core.CollectErrors = true
--HTML--
<style/onload = !-alert&#x28;1&#x29;>
--EXPECT--
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,7 @@
--INI--
HTML.Doctype = HTML 4.01 Strict
--HTML--
<b>Vetgedrukt</b> <i>Schuingedrukt</i> <span>Hou</span><iframe></iframe><script></script> jij ook zo van vakjesdenken?
--EXPECT--
<b>Vetgedrukt</b> <i>Schuingedrukt</i> <span>Hou</span> jij ook zo van vakjesdenken?
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--HTML--
<table background="logo.png"><tr><td>asdf</td></tr></table>
--EXPECT--
<table style="background-image:url(&quot;logo.png&quot;);"><tr><td>asdf</td></tr></table>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,6 @@
--INI--
HTML.Trusted = true
--HTML--
<ul><!-- Foo --></ul>
--EXPECT--
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--INI--
HTML.Trusted = true
--HTML--
<table><!-- foo --><tr><td>Foo</td></tr></table>
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,5 @@
--INI--
HTML.Trusted = true
--HTML--
<!-- Foobar -->
--# vim: et sw=4 sts=4

View File

@ -0,0 +1,3 @@
--HTML--
Foo<b> </b>bar
--# vim: et sw=4 sts=4