",
+ 'style',
+ 'HTML filter -- invalid UTF-8.',
+ array('p'),
+ ),
+ );
+ // @fixme This dataset currently fails under 5.4 because of
+ // https://drupal.org/node/1210798 . Restore after its fixed.
+ if (version_compare(PHP_VERSION, '5.4.0', '<')) {
+ $cases[] = array(
+ '',
+ 'javascript',
+ 'HTML scheme clearing evasion -- spaces and metacharacters before scheme.',
+ array('img'),
+ );
+ }
+ return $cases;
+ }
+
+ /**
+ * Checks that invalid multi-byte sequences are rejected.
+ *
+ * @param string $value
+ * The value to filter.
+ * @param string $expected
+ * The expected result.
+ * @param string $message
+ * The assertion message to display upon failure.
+ *
+ * @dataProvider providerTestInvalidMultiByte
+ */
+ public function testInvalidMultiByte($value, $expected, $message) {
+ $this->assertEquals(Xss::filter($value), $expected, $message);
+ }
+
+ /**
+ * Data provider for testInvalidMultiByte().
+ *
+ * @see testInvalidMultiByte()
+ *
+ * @return array
+ * An array of arrays containing strings:
+ * - The value to filter.
+ * - The value to expect after filtering.
+ * - The assertion message.
+ */
+ public function providerTestInvalidMultiByte() {
+ return array(
+ array("Foo\xC0barbaz", '', 'Xss::filter() accepted invalid sequence "Foo\xC0barbaz"'),
+ array("Fooÿñ", "Fooÿñ", 'Xss::filter() rejects valid sequence Fooÿñ"'),
+ array("\xc0aaa", '', 'HTML filter -- overlong UTF-8 sequences.'),
+ );
+ }
+
+ /**
+ * Checks that strings starting with a question sign are correctly processed.
+ */
+ public function testQuestionSign() {
+ $value = Xss::filter('');
+ $this->assertTrue(stripos($value, '
');
+ $this->assertEquals($value, '', 'Admin HTML filter -- should never allow some tags.');
+ }
+
+ /**
+ * Tests the loose, admin HTML filter.
+ *
+ * @param string $value
+ * The value to filter.
+ * @param string $expected
+ * The expected result.
+ * @param string $message
+ * The assertion message to display upon failure.
+ *
+ * @dataProvider providerTestFilterXssAdminNotNormalized
+ */
+ public function testFilterXssAdminNotNormalized($value, $expected, $message) {
+ $this->assertNotNormalized(Xss::filterAdmin($value), $expected, $message);
+ }
+
+ /**
+ * Data provider for testFilterXssAdminNotNormalized().
+ *
+ * @see testFilterXssAdminNotNormalized()
+ *
+ * @return array
+ * An array of arrays containing strings:
+ * - The value to filter.
+ * - The value to expect after filtering.
+ * - The assertion message.
+ */
+ public function providerTestFilterXssAdminNotNormalized() {
+ return array(
+ // DRUPAL-SA-2008-044
+ array('', 'object', 'Admin HTML filter -- should not allow object tag.'),
+ array('', 'script', 'Admin HTML filter -- should not allow script tag.'),
+ );
+ }
+
+ /**
+ * Asserts that a text transformed to lowercase with HTML entities decoded does contains a given string.
+ *
+ * Otherwise fails the test with a given message, similar to all the
+ * SimpleTest assert* functions.
+ *
+ * Note that this does not remove nulls, new lines and other characters that
+ * could be used to obscure a tag or an attribute name.
+ *
+ * @param string $haystack
+ * Text to look in.
+ * @param string $needle
+ * Lowercase, plain text to look for.
+ * @param string $message
+ * (optional) Message to display if failed. Defaults to an empty string.
+ * @param string $group
+ * (optional) The group this message belongs to. Defaults to 'Other'.
+ */
+ protected function assertNormalized($haystack, $needle, $message = '', $group = 'Other') {
+ $this->assertTrue(strpos(strtolower(String::decodeEntities($haystack)), $needle) !== FALSE, $message, $group);
+ }
+
+ /**
+ * Asserts that text transformed to lowercase with HTML entities decoded does not contain a given string.
+ *
+ * Otherwise fails the test with a given message, similar to all the
+ * SimpleTest assert* functions.
+ *
+ * Note that this does not remove nulls, new lines, and other character that
+ * could be used to obscure a tag or an attribute name.
+ *
+ * @param string $haystack
+ * Text to look in.
+ * @param string $needle
+ * Lowercase, plain text to look for.
+ * @param string $message
+ * (optional) Message to display if failed. Defaults to an empty string.
+ * @param string $group
+ * (optional) The group this message belongs to. Defaults to 'Other'.
+ */
+ protected function assertNotNormalized($haystack, $needle, $message = '', $group = 'Other') {
+ $this->assertTrue(strpos(strtolower(String::decodeEntities($haystack)), $needle) === FALSE, $message, $group);
+ }
+
+}