1246 lines
60 KiB
Plaintext
1246 lines
60 KiB
Plaintext
<?php
|
|
// $Id$
|
|
|
|
/**
|
|
* Tests for text format and filter CRUD operations.
|
|
*/
|
|
class FilterCRUDTestCase extends DrupalWebTestCase {
|
|
public static function getInfo() {
|
|
return array(
|
|
'name' => 'Filter CRUD operations',
|
|
'description' => 'Test creation, loading, updating, deleting of text formats and filters.',
|
|
'group' => 'Filter',
|
|
);
|
|
}
|
|
|
|
function setUp() {
|
|
parent::setUp('filter_test');
|
|
}
|
|
|
|
/**
|
|
* Test CRUD operations for text formats and filters.
|
|
*/
|
|
function testTextFormatCRUD() {
|
|
// Add a text format with minimum data only.
|
|
$format = new stdClass;
|
|
$format->name = 'Empty format';
|
|
filter_format_save($format);
|
|
$this->verifyTextFormat($format);
|
|
$this->verifyFilters($format);
|
|
|
|
// Add another text format specifying all possible properties.
|
|
$format = new stdClass;
|
|
$format->name = 'Custom format';
|
|
$format->filters = array(
|
|
'filter_url' => array(
|
|
'status' => 1,
|
|
'settings' => array(
|
|
'filter_url_length' => 30,
|
|
),
|
|
),
|
|
);
|
|
filter_format_save($format);
|
|
$this->verifyTextFormat($format);
|
|
$this->verifyFilters($format);
|
|
|
|
// Alter some text format properties and save again.
|
|
$format->name = 'Altered format';
|
|
$format->filters['filter_url']['status'] = 0;
|
|
$format->filters['filter_autop']['status'] = 1;
|
|
filter_format_save($format);
|
|
$this->verifyTextFormat($format);
|
|
$this->verifyFilters($format);
|
|
|
|
// Add a uncacheable filter and save again.
|
|
$format->filters['filter_test_uncacheable']['status'] = 1;
|
|
filter_format_save($format);
|
|
$this->verifyTextFormat($format);
|
|
$this->verifyFilters($format);
|
|
|
|
// Delete the text format.
|
|
filter_format_delete($format);
|
|
$db_format = db_query("SELECT * FROM {filter_format} WHERE format = :format", array(':format' => $format->format))->fetchObject();
|
|
$this->assertFalse($db_format, t('Database: Deleted text format no longer exists.'));
|
|
$db_filters = db_query("SELECT * FROM {filter} WHERE format = :format", array(':format' => $format->format))->fetchObject();
|
|
$this->assertFalse($db_filters, t('Database: Filters for deleted text format no longer exist.'));
|
|
$formats = filter_formats();
|
|
$this->assertTrue(!isset($formats[$format->format]), t('filter_formats: Deleted text format no longer exists.'));
|
|
}
|
|
|
|
/**
|
|
* Verify that a text format is properly stored.
|
|
*/
|
|
function verifyTextFormat($format) {
|
|
$t_args = array('%format' => $format->name);
|
|
// Verify text format database record.
|
|
$db_format = db_select('filter_format', 'ff')
|
|
->fields('ff')
|
|
->condition('format', $format->format)
|
|
->execute()
|
|
->fetchObject();
|
|
$this->assertEqual($db_format->format, $format->format, t('Database: Proper format id for text format %format.', $t_args));
|
|
$this->assertEqual($db_format->name, $format->name, t('Database: Proper title for text format %format.', $t_args));
|
|
$this->assertEqual($db_format->cache, $format->cache, t('Database: Proper cache indicator for text format %format.', $t_args));
|
|
$this->assertEqual($db_format->weight, $format->weight, t('Database: Proper weight for text format %format.', $t_args));
|
|
|
|
// Verify filter_format_load().
|
|
$filter_format = filter_format_load($format->format);
|
|
$this->assertEqual($filter_format->format, $format->format, t('filter_format_load: Proper format id for text format %format.', $t_args));
|
|
$this->assertEqual($filter_format->name, $format->name, t('filter_format_load: Proper title for text format %format.', $t_args));
|
|
$this->assertEqual($filter_format->cache, $format->cache, t('filter_format_load: Proper cache indicator for text format %format.', $t_args));
|
|
$this->assertEqual($filter_format->weight, $format->weight, t('filter_format_load: Proper weight for text format %format.', $t_args));
|
|
|
|
// Verify the 'cache' text format property according to enabled filters.
|
|
$filter_info = filter_get_filters();
|
|
$filters = filter_list_format($filter_format->format);
|
|
$cacheable = TRUE;
|
|
foreach ($filters as $name => $filter) {
|
|
// If this filter is not cacheable, update $cacheable accordingly, so we
|
|
// can verify $format->cache after iterating over all filters.
|
|
if ($filter->status && isset($filter_info[$name]['cache']) && !$filter_info[$name]['cache']) {
|
|
$cacheable = FALSE;
|
|
break;
|
|
}
|
|
}
|
|
$this->assertEqual($filter_format->cache, $cacheable, t('Text format contains proper cache property.'));
|
|
}
|
|
|
|
/**
|
|
* Verify that filters are properly stored for a text format.
|
|
*/
|
|
function verifyFilters($format) {
|
|
// Verify filter database records.
|
|
$filters = db_query("SELECT * FROM {filter} WHERE format = :format", array(':format' => $format->format))->fetchAllAssoc('name');
|
|
$format_filters = $format->filters;
|
|
foreach ($filters as $name => $filter) {
|
|
$t_args = array('%format' => $format->name, '%filter' => $name);
|
|
|
|
// Verify that filter status is properly stored.
|
|
$this->assertEqual($filter->status, $format_filters[$name]['status'], t('Database: Proper status for %filter in text format %format.', $t_args));
|
|
|
|
// Verify that filter settings were properly stored.
|
|
$this->assertEqual(unserialize($filter->settings), isset($format_filters[$name]['settings']) ? $format_filters[$name]['settings'] : array(), t('Database: Proper filter settings for %filter in text format %format.', $t_args));
|
|
|
|
// Verify that each filter has a module name assigned.
|
|
$this->assertTrue(!empty($filter->module), t('Database: Proper module name for %filter in text format %format.', $t_args));
|
|
|
|
// Remove the filter from the copy of saved $format to check whether all
|
|
// filters have been processed later.
|
|
unset($format_filters[$name]);
|
|
}
|
|
// Verify that all filters have been processed.
|
|
$this->assertTrue(empty($format_filters), t('Database contains values for all filters in the saved format.'));
|
|
|
|
// Verify filter_list_format().
|
|
$filters = filter_list_format($format->format);
|
|
$format_filters = $format->filters;
|
|
foreach ($filters as $name => $filter) {
|
|
$t_args = array('%format' => $format->name, '%filter' => $name);
|
|
|
|
// Verify that filter status is properly stored.
|
|
$this->assertEqual($filter->status, $format_filters[$name]['status'], t('filter_list_format: Proper status for %filter in text format %format.', $t_args));
|
|
|
|
// Verify that filter settings were properly stored.
|
|
$this->assertEqual($filter->settings, isset($format_filters[$name]['settings']) ? $format_filters[$name]['settings'] : array(), t('filter_list_format: Proper filter settings for %filter in text format %format.', $t_args));
|
|
|
|
// Verify that each filter has a module name assigned.
|
|
$this->assertTrue(!empty($filter->module), t('filter_list_format: Proper module name for %filter in text format %format.', $t_args));
|
|
|
|
// Remove the filter from the copy of saved $format to check whether all
|
|
// filters have been processed later.
|
|
unset($format_filters[$name]);
|
|
}
|
|
// Verify that all filters have been processed.
|
|
$this->assertTrue(empty($format_filters), t('filter_list_format: Loaded filters contain values for all filters in the saved format.'));
|
|
}
|
|
}
|
|
|
|
class FilterAdminTestCase extends DrupalWebTestCase {
|
|
public static function getInfo() {
|
|
return array(
|
|
'name' => 'Filter administration functionality',
|
|
'description' => 'Thoroughly test the administrative interface of the filter module.',
|
|
'group' => 'Filter',
|
|
);
|
|
}
|
|
|
|
function setUp() {
|
|
parent::setUp();
|
|
|
|
// Create users.
|
|
$filtered_html_format = db_query_range('SELECT * FROM {filter_format} WHERE name = :name', 0, 1, array(':name' => 'Filtered HTML'))->fetchObject();
|
|
$full_html_format = db_query_range('SELECT * FROM {filter_format} WHERE name = :name', 0, 1, array(':name' => 'Full HTML'))->fetchObject();
|
|
$this->admin_user = $this->drupalCreateUser(array(
|
|
'administer filters',
|
|
filter_permission_name($filtered_html_format),
|
|
filter_permission_name($full_html_format),
|
|
));
|
|
|
|
$this->web_user = $this->drupalCreateUser(array('create page content', 'edit own page content'));
|
|
$this->drupalLogin($this->admin_user);
|
|
}
|
|
|
|
function testFormatAdmin() {
|
|
// Add text format.
|
|
$this->drupalGet('admin/config/content/formats');
|
|
$this->clickLink('Add text format');
|
|
$edit = array(
|
|
'name' => $this->randomName(),
|
|
);
|
|
$this->drupalPost(NULL, $edit, t('Save configuration'));
|
|
|
|
// Edit text format.
|
|
$format = $this->getFormat($edit['name']);
|
|
$this->drupalGet('admin/config/content/formats');
|
|
$this->assertRaw('admin/config/content/formats/' . $format->format);
|
|
$this->drupalGet('admin/config/content/formats/' . $format->format);
|
|
$this->drupalPost(NULL, array(), t('Save configuration'));
|
|
|
|
// Delete text format.
|
|
$this->drupalGet('admin/config/content/formats');
|
|
$this->assertRaw('admin/config/content/formats/' . $format->format . '/delete');
|
|
$this->drupalGet('admin/config/content/formats/' . $format->format . '/delete');
|
|
$this->drupalPost(NULL, array(), t('Delete'));
|
|
|
|
// Verify that deleted text format no longer exists.
|
|
$this->drupalGet('admin/config/content/formats/' . $format->format);
|
|
$this->assertResponse(404, t('Deleted text format no longer exists.'));
|
|
}
|
|
|
|
/**
|
|
* Test filter administration functionality.
|
|
*/
|
|
function testFilterAdmin() {
|
|
// URL filter.
|
|
$first_filter = 'filter_url';
|
|
// Line filter.
|
|
$second_filter = 'filter_autop';
|
|
|
|
list($filtered, $full, $plain) = $this->checkFilterFormats();
|
|
|
|
// Check that the fallback format exists and cannot be deleted.
|
|
$this->assertTrue(!empty($plain) && $plain == filter_fallback_format(), t('The fallback format is set to plain text.'));
|
|
$this->drupalGet('admin/config/content/formats');
|
|
$this->assertNoRaw('admin/config/content/formats/' . $plain . '/delete', t('Delete link for the fallback format not found.'));
|
|
$this->drupalGet('admin/config/content/formats/' . $plain . '/delete');
|
|
$this->assertResponse(403, t('The fallback format cannot be deleted.'));
|
|
|
|
// Verify access permissions to Full HTML format.
|
|
$this->assertTrue(filter_access(filter_format_load($full), $this->admin_user), t('Admin user may use Full HTML.'));
|
|
$this->assertFalse(filter_access(filter_format_load($full), $this->web_user), t('Web user may not use Full HTML.'));
|
|
|
|
// Add an additional tag.
|
|
$edit = array();
|
|
$edit['filters[filter_html][settings][allowed_html]'] = '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <quote>';
|
|
$this->drupalPost('admin/config/content/formats/' . $filtered, $edit, t('Save configuration'));
|
|
$this->assertFieldByName('filters[filter_html][settings][allowed_html]', $edit['filters[filter_html][settings][allowed_html]'], t('Allowed HTML tag added.'));
|
|
|
|
$result = db_query('SELECT * FROM {cache_filter}')->fetchObject();
|
|
$this->assertFalse($result, t('Cache cleared.'));
|
|
|
|
$elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]', array(
|
|
':first' => 'filters[' . $first_filter . '][weight]',
|
|
':second' => 'filters[' . $second_filter . '][weight]',
|
|
));
|
|
$this->assertTrue(!empty($elements), t('Order confirmed in admin interface.'));
|
|
|
|
// Reorder filters.
|
|
$edit = array();
|
|
$edit['filters[' . $second_filter . '][weight]'] = 1;
|
|
$edit['filters[' . $first_filter . '][weight]'] = 2;
|
|
$this->drupalPost(NULL, $edit, t('Save configuration'));
|
|
$this->assertFieldByName('filters[' . $second_filter . '][weight]', 1, t('Order saved successfully.'));
|
|
$this->assertFieldByName('filters[' . $first_filter . '][weight]', 2, t('Order saved successfully.'));
|
|
|
|
$elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]', array(
|
|
':first' => 'filters[' . $second_filter . '][weight]',
|
|
':second' => 'filters[' . $first_filter . '][weight]',
|
|
));
|
|
$this->assertTrue(!empty($elements), t('Reorder confirmed in admin interface.'));
|
|
|
|
$result = db_query('SELECT * FROM {filter} WHERE format = :format ORDER BY weight ASC', array(':format' => $filtered));
|
|
$filters = array();
|
|
foreach ($result as $filter) {
|
|
if ($filter->name == $second_filter || $filter->name == $first_filter) {
|
|
$filters[] = $filter;
|
|
}
|
|
}
|
|
$this->assertTrue(($filters[0]->name == $second_filter && $filters[1]->name == $first_filter), t('Order confirmed in database.'));
|
|
|
|
// Add format.
|
|
$edit = array();
|
|
$edit['name'] = $this->randomName();
|
|
$edit['roles[2]'] = 1;
|
|
$edit['filters[' . $second_filter . '][status]'] = TRUE;
|
|
$edit['filters[' . $first_filter . '][status]'] = TRUE;
|
|
$this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));
|
|
$this->assertRaw(t('Added text format %format.', array('%format' => $edit['name'])), t('New filter created.'));
|
|
|
|
$format = $this->getFormat($edit['name']);
|
|
$this->assertNotNull($format, t('Format found in database.'));
|
|
|
|
$this->assertFieldByName('roles[2]', '', t('Role found.'));
|
|
$this->assertFieldByName('filters[' . $second_filter . '][status]', '', t('Line break filter found.'));
|
|
$this->assertFieldByName('filters[' . $first_filter . '][status]', '', t('Url filter found.'));
|
|
|
|
// Delete new filter.
|
|
$this->drupalPost('admin/config/content/formats/' . $format->format . '/delete', array(), t('Delete'));
|
|
$this->assertRaw(t('Deleted text format %format.', array('%format' => $edit['name'])), t('Format successfully deleted.'));
|
|
|
|
// Allow authenticated users on full HTML.
|
|
$format = filter_format_load($full);
|
|
$edit = array();
|
|
$edit['roles[1]'] = 0;
|
|
$edit['roles[2]'] = 1;
|
|
$this->drupalPost('admin/config/content/formats/' . $full, $edit, t('Save configuration'));
|
|
$this->assertRaw(t('The text format %format has been updated.', array('%format' => $format->name)), t('Full HTML format successfully updated.'));
|
|
|
|
// Switch user.
|
|
$this->drupalLogout();
|
|
$this->drupalLogin($this->web_user);
|
|
|
|
$this->drupalGet('node/add/page');
|
|
$this->assertRaw('<option value="' . $full . '">Full HTML</option>', t('Full HTML filter accessible.'));
|
|
|
|
// Use filtered HTML and see if it removes tags that are not allowed.
|
|
$body = '<em>' . $this->randomName() . '</em>';
|
|
$extra_text = 'text';
|
|
$text = $body . '<random>' . $extra_text . '</random>';
|
|
|
|
$edit = array();
|
|
$langcode = LANGUAGE_NONE;
|
|
$edit["title"] = $this->randomName();
|
|
$edit["body[$langcode][0][value]"] = $text;
|
|
$edit["body[$langcode][0][format]"] = $filtered;
|
|
$this->drupalPost('node/add/page', $edit, t('Save'));
|
|
$this->assertRaw(t('Basic page %title has been created.', array('%title' => $edit["title"])), t('Filtered node created.'));
|
|
|
|
$node = $this->drupalGetNodeByTitle($edit["title"]);
|
|
$this->assertTrue($node, t('Node found in database.'));
|
|
|
|
$this->drupalGet('node/' . $node->nid);
|
|
$this->assertRaw($body . $extra_text, t('Filter removed invalid tag.'));
|
|
|
|
// Use plain text and see if it escapes all tags, whether allowed or not.
|
|
$edit = array();
|
|
$edit["body[$langcode][0][format]"] = $plain;
|
|
$this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));
|
|
$this->drupalGet('node/' . $node->nid);
|
|
$this->assertText(check_plain($text), t('The "Plain text" text format escapes all HTML tags.'));
|
|
|
|
// Switch user.
|
|
$this->drupalLogout();
|
|
$this->drupalLogin($this->admin_user);
|
|
|
|
// Clean up.
|
|
// Allowed tags.
|
|
$edit = array();
|
|
$edit['filters[filter_html][settings][allowed_html]'] = '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>';
|
|
$this->drupalPost('admin/config/content/formats/' . $filtered, $edit, t('Save configuration'));
|
|
$this->assertFieldByName('filters[filter_html][settings][allowed_html]', $edit['filters[filter_html][settings][allowed_html]'], t('Changes reverted.'));
|
|
|
|
// Full HTML.
|
|
$edit = array();
|
|
$edit['roles[2]'] = FALSE;
|
|
$this->drupalPost('admin/config/content/formats/' . $full, $edit, t('Save configuration'));
|
|
$this->assertRaw(t('The text format %format has been updated.', array('%format' => $format->name)), t('Full HTML format successfully reverted.'));
|
|
$this->assertFieldByName('roles[2]', $edit['roles[2]'], t('Changes reverted.'));
|
|
|
|
// Filter order.
|
|
$edit = array();
|
|
$edit['filters[' . $second_filter . '][weight]'] = 2;
|
|
$edit['filters[' . $first_filter . '][weight]'] = 1;
|
|
$this->drupalPost('admin/config/content/formats/' . $filtered, $edit, t('Save configuration'));
|
|
$this->assertFieldByName('filters[' . $second_filter . '][weight]', $edit['filters[' . $second_filter . '][weight]'], t('Changes reverted.'));
|
|
$this->assertFieldByName('filters[' . $first_filter . '][weight]', $edit['filters[' . $first_filter . '][weight]'], t('Changes reverted.'));
|
|
}
|
|
|
|
/**
|
|
* Query the database to get the three basic formats.
|
|
*
|
|
* @return
|
|
* An array containing filtered, full, and plain text format ids.
|
|
*/
|
|
function checkFilterFormats() {
|
|
$result = db_query('SELECT format, name FROM {filter_format}');
|
|
|
|
$filtered = -1;
|
|
$full = -1;
|
|
$plain = -1;
|
|
foreach ($result as $format) {
|
|
if ($format->name == 'Filtered HTML') {
|
|
$filtered = $format->format;
|
|
}
|
|
elseif ($format->name == 'Full HTML') {
|
|
$full = $format->format;
|
|
}
|
|
elseif ($format->name == 'Plain text') {
|
|
$plain = $format->format;
|
|
}
|
|
}
|
|
|
|
return array($filtered, $full, $plain);
|
|
}
|
|
|
|
/**
|
|
* Retrieve a text format object by name.
|
|
*
|
|
* @param $name
|
|
* The name of a text format.
|
|
* @return
|
|
* A text format object.
|
|
*/
|
|
function getFormat($name) {
|
|
return db_query("SELECT * FROM {filter_format} WHERE name = :name", array(':name' => $name))->fetchObject();
|
|
}
|
|
}
|
|
|
|
class FilterAccessTestCase extends DrupalWebTestCase {
|
|
protected $admin_user;
|
|
protected $web_user;
|
|
protected $allowed_format;
|
|
protected $disallowed_format;
|
|
|
|
public static function getInfo() {
|
|
return array(
|
|
'name' => 'Filter access functionality',
|
|
'description' => 'Test the filter access system.',
|
|
'group' => 'Filter',
|
|
);
|
|
}
|
|
|
|
function setUp() {
|
|
parent::setUp();
|
|
|
|
// Create two text formats and grant a regular user access to one of them.
|
|
$this->admin_user = $this->drupalCreateUser(array('administer filters'));
|
|
$this->drupalLogin($this->admin_user);
|
|
$formats = array();
|
|
for ($i = 0; $i < 2; $i++) {
|
|
$edit = array('name' => $this->randomName());
|
|
$this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));
|
|
$this->resetFilterCaches();
|
|
$format_id = db_query("SELECT format FROM {filter_format} WHERE name = :name", array(':name' => $edit['name']))->fetchField();
|
|
$formats[] = filter_format_load($format_id);
|
|
}
|
|
list($this->allowed_format, $this->disallowed_format) = $formats;
|
|
$this->web_user = $this->drupalCreateUser(array('create page content', filter_permission_name($this->allowed_format)));
|
|
}
|
|
|
|
function testFormatPermissions() {
|
|
// Make sure that a regular user only has access to the text format they
|
|
// were granted access to, as well to the fallback format.
|
|
$this->assertTrue(filter_access($this->allowed_format, $this->web_user), t('A regular user has access to a text format they were granted access to.'));
|
|
$this->assertFalse(filter_access($this->disallowed_format, $this->web_user), t('A regular user does not have access to a text format they were not granted access to.'));
|
|
$this->assertTrue(filter_access(filter_format_load(filter_fallback_format()), $this->web_user), t('A regular user has access to the fallback format.'));
|
|
|
|
// Perform similar checks as above, but now against the entire list of
|
|
// available formats for this user.
|
|
$this->assertTrue(in_array($this->allowed_format->format, array_keys(filter_formats($this->web_user))), t('The allowed format appears in the list of available formats for a regular user.'));
|
|
$this->assertFalse(in_array($this->disallowed_format->format, array_keys(filter_formats($this->web_user))), t('The disallowed format does not appear in the list of available formats for a regular user.'));
|
|
$this->assertTrue(in_array(filter_fallback_format(), array_keys(filter_formats($this->web_user))), t('The fallback format appears in the list of available formats for a regular user.'));
|
|
|
|
// Make sure that a regular user only has permission to use the format
|
|
// they were granted access to.
|
|
$this->assertTrue(user_access(filter_permission_name($this->allowed_format), $this->web_user), t('A regular user has permission to use the allowed text format.'));
|
|
$this->assertFalse(user_access(filter_permission_name($this->disallowed_format), $this->web_user), t('A regular user does not have permission to use the disallowed text format.'));
|
|
|
|
// Make sure that the allowed format appears on the node form and that
|
|
// the disallowed format does not.
|
|
$this->drupalLogin($this->web_user);
|
|
$this->drupalGet('node/add/page');
|
|
$this->assertRaw($this->formatSelectorHTML($this->allowed_format), t('The allowed text format appears as an option when adding a new node.'));
|
|
$this->assertNoRaw($this->formatSelectorHTML($this->disallowed_format), t('The disallowed text format does not appear as an option when adding a new node.'));
|
|
$this->assertRaw($this->formatSelectorHTML(filter_format_load(filter_fallback_format())), t('The fallback format appears as an option when adding a new node.'));
|
|
}
|
|
|
|
function testFormatRoles() {
|
|
// Get the role ID assigned to the regular user; it must be the maximum.
|
|
$rid = max(array_keys($this->web_user->roles));
|
|
|
|
// Check that this role appears in the list of roles that have access to an
|
|
// allowed text format, but does not appear in the list of roles that have
|
|
// access to a disallowed text format.
|
|
$this->assertTrue(in_array($rid, array_keys(filter_get_roles_by_format($this->allowed_format))), t('A role which has access to a text format appears in the list of roles that have access to that format.'));
|
|
$this->assertFalse(in_array($rid, array_keys(filter_get_roles_by_format($this->disallowed_format))), t('A role which does not have access to a text format does not appear in the list of roles that have access to that format.'));
|
|
|
|
// Check that the correct text format appears in the list of formats
|
|
// available to that role.
|
|
$this->assertTrue(in_array($this->allowed_format->format, array_keys(filter_get_formats_by_role($rid))), t('A text format which a role has access to appears in the list of formats available to that role.'));
|
|
$this->assertFalse(in_array($this->disallowed_format->format, array_keys(filter_get_formats_by_role($rid))), t('A text format which a role does not have access to does not appear in the list of formats available to that role.'));
|
|
|
|
// Check that the fallback format is always allowed.
|
|
$this->assertEqual(filter_get_roles_by_format(filter_format_load(filter_fallback_format())), user_roles(), t('All roles have access to the fallback format.'));
|
|
$this->assertTrue(in_array(filter_fallback_format(), array_keys(filter_get_formats_by_role($rid))), t('The fallback format appears in the list of allowed formats for any role.'));
|
|
}
|
|
|
|
/**
|
|
* Returns the expected HTML for a particular text format selector.
|
|
*
|
|
* @param $format
|
|
* An object representing the text format for which to return HTML.
|
|
* @return
|
|
* The expected HTML for that text format's selector.
|
|
*/
|
|
function formatSelectorHTML($format) {
|
|
return '<option value="' . $format->format . '">' . $format->name . '</option>';
|
|
}
|
|
|
|
/**
|
|
* Rebuild text format and permission caches in the thread running the tests.
|
|
*/
|
|
protected function resetFilterCaches() {
|
|
filter_formats_reset();
|
|
$this->checkPermissions(array(), TRUE);
|
|
}
|
|
}
|
|
|
|
class FilterDefaultFormatTestCase extends DrupalWebTestCase {
|
|
public static function getInfo() {
|
|
return array(
|
|
'name' => 'Default text format functionality',
|
|
'description' => 'Test the default text formats for different users.',
|
|
'group' => 'Filter',
|
|
);
|
|
}
|
|
|
|
function testDefaultTextFormats() {
|
|
// Create two text formats, and two users. The first user has access to
|
|
// both formats, but the second user only has access to the second one.
|
|
$admin_user = $this->drupalCreateUser(array('administer filters'));
|
|
$this->drupalLogin($admin_user);
|
|
$formats = array();
|
|
for ($i = 0; $i < 2; $i++) {
|
|
$edit = array('name' => $this->randomName());
|
|
$this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));
|
|
$this->resetFilterCaches();
|
|
$format_id = db_query("SELECT format FROM {filter_format} WHERE name = :name", array(':name' => $edit['name']))->fetchField();
|
|
$formats[] = filter_format_load($format_id);
|
|
}
|
|
list($first_format, $second_format) = $formats;
|
|
$first_user = $this->drupalCreateUser(array(filter_permission_name($first_format), filter_permission_name($second_format)));
|
|
$second_user = $this->drupalCreateUser(array(filter_permission_name($second_format)));
|
|
|
|
// Adjust the weights so that the first and second formats (in that order)
|
|
// are the two lowest weighted formats available to any user.
|
|
$minimum_weight = db_query("SELECT MIN(weight) FROM {filter_format}")->fetchField();
|
|
$edit = array();
|
|
$edit['formats[' . $first_format->format . '][weight]'] = $minimum_weight - 2;
|
|
$edit['formats[' . $second_format->format . '][weight]'] = $minimum_weight - 1;
|
|
$this->drupalPost('admin/config/content/formats', $edit, t('Save changes'));
|
|
$this->resetFilterCaches();
|
|
|
|
// Check that each user's default format is the lowest weighted format that
|
|
// the user has access to.
|
|
$this->assertEqual(filter_default_format($first_user), $first_format->format, t("The first user's default format is the lowest weighted format that the user has access to."));
|
|
$this->assertEqual(filter_default_format($second_user), $second_format->format, t("The second user's default format is the lowest weighted format that the user has access to, and is different than the first user's."));
|
|
|
|
// Reorder the two formats, and check that both users now have the same
|
|
// default.
|
|
$edit = array();
|
|
$edit['formats[' . $second_format->format . '][weight]'] = $minimum_weight - 3;
|
|
$this->drupalPost('admin/config/content/formats', $edit, t('Save changes'));
|
|
$this->resetFilterCaches();
|
|
$this->assertEqual(filter_default_format($first_user), filter_default_format($second_user), t('After the formats are reordered, both users have the same default format.'));
|
|
}
|
|
|
|
/**
|
|
* Rebuild text format and permission caches in the thread running the tests.
|
|
*/
|
|
protected function resetFilterCaches() {
|
|
filter_formats_reset();
|
|
$this->checkPermissions(array(), TRUE);
|
|
}
|
|
}
|
|
|
|
class FilterNoFormatTestCase extends DrupalWebTestCase {
|
|
public static function getInfo() {
|
|
return array(
|
|
'name' => 'Unassigned text format functionality',
|
|
'description' => 'Test the behavior of check_markup() when it is called without a text format.',
|
|
'group' => 'Filter',
|
|
);
|
|
}
|
|
|
|
function testCheckMarkupNoFormat() {
|
|
// Create some text. Include some HTML and line breaks, so we get a good
|
|
// test of the filtering that is applied to it.
|
|
$text = "<strong>" . $this->randomName(32) . "</strong>\n\n<div>" . $this->randomName(32) . "</div>";
|
|
|
|
// Make sure that when this text is run through check_markup() with no text
|
|
// format, it is filtered as though it is in the fallback format.
|
|
$this->assertEqual(check_markup($text), check_markup($text, filter_fallback_format()), t('Text with no format is filtered the same as text in the fallback format.'));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Unit tests for core filters.
|
|
*/
|
|
class FilterUnitTestCase extends DrupalUnitTestCase {
|
|
public static function getInfo() {
|
|
return array(
|
|
'name' => 'Core filters',
|
|
'description' => 'Filter each filter individually: convert line breaks, correct broken HTML.',
|
|
'group' => 'Filter',
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Test the line break filter.
|
|
*/
|
|
function testLineBreakFilter() {
|
|
// Single line breaks should be changed to <br /> tags, while paragraphs
|
|
// separated with double line breaks should be enclosed with <p></p> tags.
|
|
$f = _filter_autop("aaa\nbbb\n\nccc");
|
|
$this->assertEqual(str_replace("\n", '', $f), "<p>aaa<br />bbb</p><p>ccc</p>", t('Line breaking basic case.'));
|
|
|
|
// Text within some contexts should not be processed.
|
|
$f = _filter_autop("<script>aaa\nbbb\n\nccc</script>");
|
|
$this->assertEqual($f, "<script>aaa\nbbb\n\nccc</script>", t('Line breaking -- do not break scripts.'));
|
|
|
|
$f = _filter_autop('<p><div> </div></p>');
|
|
$this->assertEqual(substr_count($f, '<p>'), substr_count($f, '</p>'), t('Make sure line breaking produces matching paragraph tags.'));
|
|
|
|
$f = _filter_autop('<div><p> </p></div>');
|
|
$this->assertEqual(substr_count($f, '<p>'), substr_count($f, '</p>'), t('Make sure line breaking produces matching paragraph tags.'));
|
|
|
|
$f = _filter_autop('<blockquote><pre>aaa</pre></blockquote>');
|
|
$this->assertEqual(substr_count($f, '<p>'), substr_count($f, '</p>'), t('Make sure line breaking produces matching paragraph tags.'));
|
|
|
|
$limit = max(ini_get('pcre.backtrack_limit'), ini_get('pcre.recursion_limit'));
|
|
$f = _filter_autop($this->randomName($limit));
|
|
$this->assertNotEqual($f, '', t('Make sure line breaking can process long strings.'));
|
|
}
|
|
|
|
/**
|
|
* Test limiting allowed tags, XSS prevention and adding 'nofollow' to links.
|
|
*
|
|
* XSS tests assume that script is disallowed on default and src is allowed
|
|
* on default, but on* and style are disallowed.
|
|
*
|
|
* Script injection vectors mostly adopted from http://ha.ckers.org/xss.html.
|
|
*
|
|
* Relevant CVEs:
|
|
* - CVE-2002-1806, ~CVE-2005-0682, ~CVE-2005-2106, CVE-2005-3973,
|
|
* CVE-2006-1226 (= rev. 1.112?), CVE-2008-0273, CVE-2008-3740.
|
|
*/
|
|
function testHtmlFilter() {
|
|
// Tag stripping, different ways to work around removal of HTML tags.
|
|
$f = filter_xss('<script>alert(0)</script>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping -- simple script without special characters.'));
|
|
|
|
$f = filter_xss('<script src="http://www.example.com" />');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping -- empty script with source.'));
|
|
|
|
$f = filter_xss('<ScRipt sRc=http://www.example.com/>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- varying case.'));
|
|
|
|
$f = filter_xss("<script\nsrc\n=\nhttp://www.example.com/\n>");
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- multiline tag.'));
|
|
|
|
$f = filter_xss('<script/a src=http://www.example.com/a.js></script>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- non whitespace character after tag name.'));
|
|
|
|
$f = filter_xss('<script/src=http://www.example.com/a.js></script>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no space between tag and attribute.'));
|
|
|
|
// Null between < and tag name works at least with IE6.
|
|
$f = filter_xss("<\0scr\0ipt>alert(0)</script>");
|
|
$this->assertNoNormalized($f, 'ipt', t('HTML tag stripping evasion -- breaking HTML with nulls.'));
|
|
|
|
$f = filter_xss("<scrscriptipt src=http://www.example.com/a.js>");
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- filter just removing "script".'));
|
|
|
|
$f = filter_xss('<<script>alert(0);//<</script>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- double opening brackets.'));
|
|
|
|
$f = filter_xss('<script src=http://www.example.com/a.js?<b>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no closing tag.'));
|
|
|
|
// DRUPAL-SA-2008-047: This doesn't seem exploitable, but the filter should
|
|
// work consistently.
|
|
$f = filter_xss('<script>>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- double closing tag.'));
|
|
|
|
$f = filter_xss('<script src=//www.example.com/.a>');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no scheme or ending slash.'));
|
|
|
|
$f = filter_xss('<script src=http://www.example.com/.a');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no closing bracket.'));
|
|
|
|
$f = filter_xss('<script src=http://www.example.com/ <');
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- opening instead of closing bracket.'));
|
|
|
|
$f = filter_xss('<nosuchtag attribute="newScriptInjectionVector">');
|
|
$this->assertNoNormalized($f, 'nosuchtag', t('HTML tag stripping evasion -- unknown tag.'));
|
|
|
|
$f = filter_xss('<?xml:namespace ns="urn:schemas-microsoft-com:time">');
|
|
$this->assertTrue(stripos($f, '<?xml') === FALSE, t('HTML tag stripping evasion -- starting with a question sign (processing instructions).'));
|
|
|
|
$f = filter_xss('<t:set attributeName="innerHTML" to="<script defer>alert(0)</script>">');
|
|
$this->assertNoNormalized($f, 't:set', t('HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).'));
|
|
|
|
$f = filter_xss('<img """><script>alert(0)</script>', array('img'));
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- a malformed image tag.'));
|
|
|
|
$f = filter_xss('<blockquote><script>alert(0)</script></blockquote>', array('blockquote'));
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- script in a blockqoute.'));
|
|
|
|
$f = filter_xss("<!--[if true]><script>alert(0)</script><![endif]-->");
|
|
$this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- script within a comment.'));
|
|
|
|
// Dangerous attributes removal.
|
|
$f = filter_xss('<p onmouseover="http://www.example.com/">', array('p'));
|
|
$this->assertNoNormalized($f, 'onmouseover', t('HTML filter attributes removal -- events, no evasion.'));
|
|
|
|
$f = filter_xss('<li style="list-style-image: url(javascript:alert(0))">', array('li'));
|
|
$this->assertNoNormalized($f, 'style', t('HTML filter attributes removal -- style, no evasion.'));
|
|
|
|
$f = filter_xss('<img onerror =alert(0)>', array('img'));
|
|
$this->assertNoNormalized($f, 'onerror', t('HTML filter attributes removal evasion -- spaces before equals sign.'));
|
|
|
|
$f = filter_xss('<img onabort!#$%&()*~+-_.,:;?@[/|\]^`=alert(0)>', array('img'));
|
|
$this->assertNoNormalized($f, 'onabort', t('HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.'));
|
|
|
|
$f = filter_xss('<img oNmediAError=alert(0)>', array('img'));
|
|
$this->assertNoNormalized($f, 'onmediaerror', t('HTML filter attributes removal evasion -- varying case.'));
|
|
|
|
// Works at least with IE6.
|
|
$f = filter_xss("<img o\0nfocus\0=alert(0)>", array('img'));
|
|
$this->assertNoNormalized($f, 'focus', t('HTML filter attributes removal evasion -- breaking with nulls.'));
|
|
|
|
// Only whitelisted scheme names allowed in attributes.
|
|
$f = filter_xss('<img src="javascript:alert(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- no evasion.'));
|
|
|
|
$f = filter_xss('<img src=javascript:alert(0)>', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- no quotes.'));
|
|
|
|
// A bit like CVE-2006-0070.
|
|
$f = filter_xss('<img src="javascript:confirm(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- no alert ;)'));
|
|
|
|
$f = filter_xss('<img src=`javascript:alert(0)`>', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- grave accents.'));
|
|
|
|
$f = filter_xss('<img dynsrc="javascript:alert(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- rare attribute.'));
|
|
|
|
$f = filter_xss('<table background="javascript:alert(0)">', array('table'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- another tag.'));
|
|
|
|
$f = filter_xss('<base href="javascript:alert(0);//">', array('base'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- one more attribute and tag.'));
|
|
|
|
$f = filter_xss('<img src="jaVaSCriPt:alert(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- varying case.'));
|
|
|
|
$f = filter_xss('<img src=javascript:alert(0)>', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- UTF-8 decimal encoding.'));
|
|
|
|
$f = filter_xss('<img src=javascript:alert(0)>', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- long UTF-8 encoding.'));
|
|
|
|
$f = filter_xss('<img src=javascript:alert(0)>', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- UTF-8 hex encoding.'));
|
|
|
|
$f = filter_xss("<img src=\"jav\tascript:alert(0)\">", array('img'));
|
|
$this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an embedded tab.'));
|
|
|
|
$f = filter_xss('<img src="jav	ascript:alert(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an encoded, embedded tab.'));
|
|
|
|
$f = filter_xss('<img src="jav
ascript:alert(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an encoded, embedded newline.'));
|
|
|
|
// With 
 this test would fail, but the entity gets turned into
|
|
// &#xD;, so it's OK.
|
|
$f = filter_xss('<img src="jav
ascript:alert(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an encoded, embedded carriage return.'));
|
|
|
|
$f = filter_xss("<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">", array('img'));
|
|
$this->assertNoNormalized($f, 'cript', t('HTML scheme clearing evasion -- broken into many lines.'));
|
|
|
|
$f = filter_xss("<img src=\"jav\0a\0\0cript:alert(0)\">", array('img'));
|
|
$this->assertNoNormalized($f, 'cript', t('HTML scheme clearing evasion -- embedded nulls.'));
|
|
|
|
$f = filter_xss('<img src="  javascript:alert(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- spaces and metacharacters before scheme.'));
|
|
|
|
$f = filter_xss('<img src="vbscript:msgbox(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'vbscript', t('HTML scheme clearing evasion -- another scheme.'));
|
|
|
|
$f = filter_xss('<img src="nosuchscheme:notice(0)">', array('img'));
|
|
$this->assertNoNormalized($f, 'nosuchscheme', t('HTML scheme clearing evasion -- unknown scheme.'));
|
|
|
|
// Netscape 4.x javascript entities.
|
|
$f = filter_xss('<br size="&{alert(0)}">', array('br'));
|
|
$this->assertNoNormalized($f, 'alert', t('Netscape 4.x javascript entities.'));
|
|
|
|
// DRUPAL-SA-2008-006: Invalid UTF-8, these only work as reflected XSS with
|
|
// Internet Explorer 6.
|
|
$f = filter_xss("<p arg=\"\xe0\">\" style=\"background-image: url(javascript:alert(0));\"\xe0<p>", array('p'));
|
|
$this->assertNoNormalized($f, 'style', t('HTML filter -- invalid UTF-8.'));
|
|
|
|
$f = filter_xss("\xc0aaa");
|
|
$this->assertEqual($f, '', t('HTML filter -- overlong UTF-8 sequences.'));
|
|
|
|
$f = filter_xss("Who's Online");
|
|
$this->assertNormalized($f, "who's online", t('HTML filter -- html entity number'));
|
|
|
|
$f = filter_xss("Who&#039;s Online");
|
|
$this->assertNormalized($f, "who's online", t('HTML filter -- encoded html entity number'));
|
|
|
|
$f = filter_xss("Who&amp;#039; Online");
|
|
$this->assertNormalized($f, "who&#039; online", t('HTML filter -- double encoded html entity number'));
|
|
}
|
|
|
|
/**
|
|
* Test filter settings, defaults, access restrictions and similar.
|
|
*
|
|
* @todo This is for functions like filter_filter and check_markup, whose
|
|
* functionality is not completely focused on filtering. Some ideas:
|
|
* restricting formats according to user permissions, proper cache
|
|
* handling, defaults -- allowed tags/attributes/protocols.
|
|
*
|
|
* @todo It is possible to add script, iframe etc. to allowed tags, but this
|
|
* makes HTML filter completely ineffective.
|
|
*
|
|
* @todo Class, id, name and xmlns should be added to disallowed attributes,
|
|
* or better a whitelist approach should be used for that too.
|
|
*/
|
|
function testFilter() {
|
|
// Setup dummy filter object.
|
|
$filter = new stdClass;
|
|
$filter->settings = array(
|
|
'allowed_html' => '<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>',
|
|
'filter_html_help' => 1,
|
|
'filter_html_nofollow' => 0,
|
|
);
|
|
|
|
// HTML filter is not able to secure some tags, these should never be
|
|
// allowed.
|
|
$f = _filter_html('<script />', $filter);
|
|
$this->assertNoNormalized($f, 'script', t('HTML filter should always remove script tags.'));
|
|
|
|
$f = _filter_html('<iframe />', $filter);
|
|
$this->assertNoNormalized($f, 'iframe', t('HTML filter should always remove iframe tags.'));
|
|
|
|
$f = _filter_html('<object />', $filter);
|
|
$this->assertNoNormalized($f, 'object', t('HTML filter should always remove object tags.'));
|
|
|
|
$f = _filter_html('<style />', $filter);
|
|
$this->assertNoNormalized($f, 'style', t('HTML filter should always remove style tags.'));
|
|
|
|
// Some tags make CSRF attacks easier, let the user take the risk herself.
|
|
$f = _filter_html('<img />', $filter);
|
|
$this->assertNoNormalized($f, 'img', t('HTML filter should remove img tags on default.'));
|
|
|
|
$f = _filter_html('<input />', $filter);
|
|
$this->assertNoNormalized($f, 'img', t('HTML filter should remove input tags on default.'));
|
|
|
|
// Filtering content of some attributes is infeasible, these shouldn't be
|
|
// allowed too.
|
|
$f = _filter_html('<p style="display: none;" />', $filter);
|
|
$this->assertNoNormalized($f, 'style', t('HTML filter should remove style attribute on default.'));
|
|
|
|
$f = _filter_html('<p onerror="alert(0);" />', $filter);
|
|
$this->assertNoNormalized($f, 'onerror', t('HTML filter should remove on* attributes on default.'));
|
|
}
|
|
|
|
/**
|
|
* Test the spam deterrent.
|
|
*/
|
|
function testNoFollowFilter() {
|
|
// Setup dummy filter object.
|
|
$filter = new stdClass;
|
|
$filter->settings = array(
|
|
'allowed_html' => '<a>',
|
|
'filter_html_help' => 1,
|
|
'filter_html_nofollow' => 1,
|
|
);
|
|
|
|
// Test if the rel="nofollow" attribute is added, even if we try to prevent
|
|
// it.
|
|
$f = _filter_html('<a href="http://www.example.com/">text</a>', $filter);
|
|
$this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent -- no evasion.'));
|
|
|
|
$f = _filter_html('<A href="http://www.example.com/">text</a>', $filter);
|
|
$this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- capital A.'));
|
|
|
|
$f = _filter_html("<a/href=\"http://www.example.com/\">text</a>", $filter);
|
|
$this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- non whitespace character after tag name.'));
|
|
|
|
$f = _filter_html("<\0a\0 href=\"http://www.example.com/\">text</a>", $filter);
|
|
$this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- some nulls.'));
|
|
|
|
$f = _filter_html('<!--[if true]><a href="http://www.example.com/">text</a><![endif]-->', $filter);
|
|
$this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- link within a comment.'));
|
|
|
|
$f = _filter_html('<a href="http://www.example.com/" rel="follow">text</a>', $filter);
|
|
$this->assertNoNormalized($f, 'rel="follow"', t('Spam deterrent evasion -- with rel set - rel="follow" removed.'));
|
|
$this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- with rel set - rel="nofollow" added.'));
|
|
}
|
|
|
|
/**
|
|
* Test the loose, admin HTML filter.
|
|
*/
|
|
function testAdminHtmlFilter() {
|
|
// DRUPAL-SA-2008-044
|
|
$f = filter_xss_admin('<object />');
|
|
$this->assertNoNormalized($f, 'object', t('Admin HTML filter -- should not allow object tag.'));
|
|
|
|
$f = filter_xss_admin('<script />');
|
|
$this->assertNoNormalized($f, 'script', t('Admin HTML filter -- should not allow script tag.'));
|
|
|
|
$f = filter_xss_admin('<style /><iframe /><frame /><frameset /><meta /><link /><embed /><applet /><param /><layer />');
|
|
$this->assertEqual($f, '', t('Admin HTML filter -- should never allow some tags.'));
|
|
}
|
|
|
|
/**
|
|
* Test the HTML escaping filter.
|
|
*/
|
|
function testNoHtmlFilter() {
|
|
$this->_testEscapedHTML('_filter_html_escape');
|
|
}
|
|
|
|
/**
|
|
* Test that the check_plain() function escapes HTML correctly.
|
|
*/
|
|
function testCheckPlain() {
|
|
$this->_testEscapedHTML('check_plain');
|
|
}
|
|
|
|
/**
|
|
* Test the URL filter.
|
|
*/
|
|
function testUrlFilter() {
|
|
// Setup dummy filter object.
|
|
$filter = new stdClass;
|
|
$filter->settings = array(
|
|
'filter_url_length' => 496,
|
|
);
|
|
|
|
// Converting URLs.
|
|
$f = _filter_url('http://www.example.com/', $filter);
|
|
$this->assertEqual($f, '<a href="http://www.example.com/" title="http://www.example.com/">http://www.example.com/</a>', t('Converting URLs.'));
|
|
|
|
$f = _filter_url('http://www.example.com/?a=1&b=2', $filter);
|
|
$this->assertEqual($f, '<a href="http://www.example.com/?a=1&b=2" title="http://www.example.com/?a=1&b=2">http://www.example.com/?a=1&b=2</a>', t('Converting URLs -- ampersands.'));
|
|
|
|
$f = _filter_url('ftp://user:pass@ftp.example.com/dir1/dir2', $filter);
|
|
$this->assertEqual($f, '<a href="ftp://user:pass@ftp.example.com/dir1/dir2" title="ftp://user:pass@ftp.example.com/dir1/dir2">ftp://user:pass@ftp.example.com/dir1/dir2</a>', t('Converting URLs -- FTP scheme.'));
|
|
|
|
// Converting domain names.
|
|
$f = _filter_url('www.example.com', $filter);
|
|
$this->assertEqual($f, '<a href="http://www.example.com" title="www.example.com">www.example.com</a>', t('Converting domain names.'));
|
|
|
|
$f = _filter_url('<li>www.example.com</li>', $filter);
|
|
$this->assertEqual($f, '<li><a href="http://www.example.com" title="www.example.com">www.example.com</a></li>', t('Converting domain names -- domain in a list.'));
|
|
|
|
$f = _filter_url('(www.example.com/dir?a=1&b=2#a)', $filter);
|
|
$this->assertEqual($f, '(<a href="http://www.example.com/dir?a=1&b=2#a" title="www.example.com/dir?a=1&b=2#a">www.example.com/dir?a=1&b=2#a</a>)', t('Converting domain names -- domain in parentheses.'));
|
|
|
|
// Converting e-mail addresses.
|
|
$f = _filter_url('johndoe@example.com', $filter);
|
|
$this->assertEqual($f, '<a href="mailto:johndoe@example.com">johndoe@example.com</a>', t('Converting e-mail addresses.'));
|
|
|
|
$f = _filter_url('aaa@sub.tv', $filter);
|
|
$this->assertEqual($f, '<a href="mailto:aaa@sub.tv">aaa@sub.tv</a>', t('Converting e-mail addresses -- a short e-mail from Tuvalu.'));
|
|
|
|
// URL trimming.
|
|
$filter->settings['filter_url_length'] = 28;
|
|
|
|
$f = _filter_url('http://www.example.com/d/ff.ext?a=1&b=2#a1', $filter);
|
|
$this->assertNormalized($f, 'http://www.example.com/d/ff....', t('URL trimming.'));
|
|
|
|
// Not breaking existing links.
|
|
$f = _filter_url('<a href="http://www.example.com">www.example.com</a>', $filter);
|
|
$this->assertEqual($f, '<a href="http://www.example.com">www.example.com</a>', t('Converting URLs -- do not break existing links.'));
|
|
|
|
$f = _filter_url('<a href="foo">http://www.example.com</a>', $filter);
|
|
$this->assertEqual($f, '<a href="foo">http://www.example.com</a>', t('Converting URLs -- do not break existing, relative links.'));
|
|
|
|
// Addresses within some tags such as code or script should not be converted.
|
|
$f = _filter_url('<code>http://www.example.com</code>', $filter);
|
|
$this->assertEqual($f, '<code>http://www.example.com</code>', t('Converting URLs -- skip code contents.'));
|
|
|
|
$f = _filter_url('<code><em>http://www.example.com</em></code>', $filter);
|
|
$this->assertEqual($f, '<code><em>http://www.example.com</em></code>', t('Converting URLs -- really skip code contents.'));
|
|
|
|
$f = _filter_url('<script>http://www.example.com</script>', $filter);
|
|
$this->assertEqual($f, '<script>http://www.example.com</script>', t('Converting URLs -- do not process scripts.'));
|
|
|
|
// Addresses in attributes should not be converted.
|
|
$f = _filter_url('<p xmlns="http://www.example.com" />', $filter);
|
|
$this->assertEqual($f, '<p xmlns="http://www.example.com" />', t('Converting URLs -- do not convert addresses in attributes.'));
|
|
|
|
$f = _filter_url('<a title="Go to www.example.com" href="http://www.example.com">text</a>', $filter);
|
|
$this->assertEqual($f, '<a title="Go to www.example.com" href="http://www.example.com">text</a>', t('Converting URLs -- do not break existing links with custom title attribute.'));
|
|
|
|
// Even though a dot at the end of a URL can indicate a fully qualified
|
|
// domain name, such usage is rare compared to using a link at the end
|
|
// of a sentence, so remove the dot from the link.
|
|
// @todo It can also be used at the end of a filename or a query string.
|
|
$f = _filter_url('www.example.com.', $filter);
|
|
$this->assertEqual($f, '<a href="http://www.example.com" title="www.example.com">www.example.com</a>.', t('Converting URLs -- do not recognize a dot at the end of a domain name (FQDNs).'));
|
|
|
|
$f = _filter_url('http://www.example.com.', $filter);
|
|
$this->assertEqual($f, '<a href="http://www.example.com" title="http://www.example.com">http://www.example.com</a>.', t('Converting URLs -- do not recognize a dot at the end of an URL (FQDNs).'));
|
|
|
|
$f = _filter_url('www.example.com/index.php?a=.', $filter);
|
|
$this->assertEqual($f, '<a href="http://www.example.com/index.php?a=" title="www.example.com/index.php?a=">www.example.com/index.php?a=</a>.', t('Converting URLs -- do forget about a dot at the end of a query string.'));
|
|
}
|
|
|
|
/**
|
|
* Test the HTML corrector filter.
|
|
*
|
|
* @todo This test could really use some validity checking function.
|
|
*/
|
|
function testHtmlCorrectorFilter() {
|
|
// Tag closing.
|
|
$f = _filter_htmlcorrector('<p>text');
|
|
$this->assertEqual($f, '<p>text</p>', t('HTML corrector -- tag closing at the end of input.'));
|
|
|
|
$f = _filter_htmlcorrector('<p>text<p><p>text');
|
|
$this->assertEqual($f, '<p>text</p><p /><p>text</p>', t('HTML corrector -- tag closing.'));
|
|
|
|
$f = _filter_htmlcorrector("<ul><li>e1<li>e2");
|
|
$this->assertEqual($f, "<ul><li>e1</li><li>e2</li></ul>", t('HTML corrector -- unclosed list tags.'));
|
|
|
|
$f = _filter_htmlcorrector('<div id="d">content');
|
|
$this->assertEqual($f, '<div id="d">content</div>', t('HTML corrector -- unclosed tag with attribute.'));
|
|
|
|
// XHTML slash for empty elements.
|
|
$f = _filter_htmlcorrector('<hr><br>');
|
|
$this->assertEqual($f, '<hr /><br />', t('HTML corrector -- XHTML closing slash.'));
|
|
|
|
$f = _filter_htmlcorrector('<P>test</P>');
|
|
$this->assertEqual($f, '<p>test</p>', t('HTML corrector -- Convert uppercased tags to proper lowercased ones.'));
|
|
|
|
$f = _filter_htmlcorrector('<P>test</p>');
|
|
$this->assertEqual($f, '<p>test</p>', t('HTML corrector -- Convert uppercased tags to proper lowercased ones.'));
|
|
|
|
$f = _filter_htmlcorrector('test<hr/>');
|
|
$this->assertEqual($f, 'test<hr />', t('HTML corrector -- Let proper XHTML pass thru.'));
|
|
|
|
$f = _filter_htmlcorrector('test<hr />');
|
|
$this->assertEqual($f, 'test<hr />', t('HTML corrector -- Let proper XHTML pass thru.'));
|
|
|
|
$f = _filter_htmlcorrector('<span class="test" />');
|
|
$this->assertEqual($f, '<span class="test" />', t('HTML corrector -- Let proper XHTML pass thru.'));
|
|
|
|
$f = _filter_htmlcorrector('test1<br class="test">test2');
|
|
$this->assertEqual($f, 'test1<br class="test" />test2', t('HTML corrector -- Automatically close single tags.'));
|
|
|
|
$f = _filter_htmlcorrector('line1<hr>line2');
|
|
$this->assertEqual($f, 'line1<hr />line2', t('HTML corrector -- Automatically close single tags.'));
|
|
|
|
$f = _filter_htmlcorrector('line1<HR>line2');
|
|
$this->assertEqual($f, 'line1<hr />line2', t('HTML corrector -- Automatically close single tags.'));
|
|
|
|
$f = _filter_htmlcorrector('<img src="http://example.com/test.jpg">test</img>');
|
|
$this->assertEqual($f, '<img src="http://example.com/test.jpg" />test', t('HTML corrector -- Automatically close single tags.'));
|
|
|
|
$f = _filter_htmlcorrector('<p>line1<br/><hr/>line2</p>');
|
|
$this->assertEqual($f, '<p>line1<br /></p><hr />line2', t('HTML corrector -- Move non-inline elements outside of inline containers.'));
|
|
|
|
$f = _filter_htmlcorrector('<p>line1<div>line2</div></p>');
|
|
$this->assertEqual($f, '<p>line1</p><div>line2</div>', t('HTML corrector -- Move non-inline elements outside of inline containers.'));
|
|
|
|
$f = _filter_htmlcorrector('<p>test<p>test</p>\n');
|
|
$this->assertEqual($f, '<p>test</p><p>test</p>\n', t('HTML corrector -- Auto-close improperly nested tags.'));
|
|
|
|
$f = _filter_htmlcorrector('<p>Line1<br><STRONG>bold stuff</b>');
|
|
$this->assertEqual($f, '<p>Line1<br /><strong>bold stuff</strong></p>', t('HTML corrector -- Properly close unclosed tags, and remove useless closing tags.'));
|
|
|
|
$f = _filter_htmlcorrector('test <!-- this is a comment -->');
|
|
$this->assertEqual($f, 'test <!-- this is a comment -->', t('HTML corrector -- Do not touch HTML comments.'));
|
|
|
|
$f = _filter_htmlcorrector('test <!--this is a comment-->');
|
|
$this->assertEqual($f, 'test <!--this is a comment-->', t('HTML corrector -- Do not touch HTML comments.'));
|
|
|
|
$f = _filter_htmlcorrector('test <!-- comment <p>another
|
|
<strong>multiple</strong> line
|
|
comment</p> -->');
|
|
$this->assertEqual($f, 'test <!-- comment <p>another
|
|
<strong>multiple</strong> line
|
|
comment</p> -->', t('HTML corrector -- Do not touch HTML comments.'));
|
|
|
|
$f = _filter_htmlcorrector('test <!-- comment <p>another comment</p> -->');
|
|
$this->assertEqual($f, 'test <!-- comment <p>another comment</p> -->', t('HTML corrector -- Do not touch HTML comments.'));
|
|
|
|
$f = _filter_htmlcorrector('test <!--break-->');
|
|
$this->assertEqual($f, 'test <!--break-->', t('HTML corrector -- Do not touch HTML comments.'));
|
|
|
|
$f = _filter_htmlcorrector('<p>test\n</p>\n');
|
|
$this->assertEqual($f, '<p>test\n</p>\n', t('HTML corrector -- New-lines are accepted and kept as-is.'));
|
|
|
|
$f = _filter_htmlcorrector('<p>دروبال');
|
|
$this->assertEqual($f, '<p>دروبال</p>', t('HTML corrector -- Encoding is correctly kept.'));
|
|
|
|
$f = _filter_htmlcorrector('<script type="text/javascript">alert("test")</script>');
|
|
$this->assertEqual($f, '<script type="text/javascript">
|
|
<!--//--><![CDATA[// ><!--
|
|
alert("test")
|
|
//--><!]]>
|
|
</script>', t('HTML corrector -- CDATA added to script element'));
|
|
|
|
$f = _filter_htmlcorrector('<p><script type="text/javascript">alert("test")</script></p>');
|
|
$this->assertEqual($f, '<p><script type="text/javascript">
|
|
<!--//--><![CDATA[// ><!--
|
|
alert("test")
|
|
//--><!]]>
|
|
</script></p>', t('HTML corrector -- CDATA added to a nested script element'));
|
|
|
|
$f = _filter_htmlcorrector('<p><style> /* Styling */ body {color:red}</style></p>');
|
|
$this->assertEqual($f, '<p><style>
|
|
<!--/*--><![CDATA[/* ><!--*/
|
|
/* Styling */ body {color:red}
|
|
/*--><!]]>*/
|
|
</style></p>', t('HTML corrector -- CDATA added to a style element.'));
|
|
}
|
|
|
|
/**
|
|
* Asserts that a text transformed to lowercase with HTML entities decoded does contains a given string.
|
|
*
|
|
* Otherwise fails the test with a given message, similar to all the
|
|
* SimpleTest assert* functions.
|
|
*
|
|
* Note that this does not remove nulls, new lines and other characters that
|
|
* could be used to obscure a tag or an attribute name.
|
|
*
|
|
* @param $haystack
|
|
* Text to look in.
|
|
* @param $needle
|
|
* Lowercase, plain text to look for.
|
|
* @param $message
|
|
* Message to display if failed.
|
|
* @param $group
|
|
* The group this message belongs to, defaults to 'Other'.
|
|
* @return
|
|
* TRUE on pass, FALSE on fail.
|
|
*/
|
|
function assertNormalized($haystack, $needle, $message = '', $group = 'Other') {
|
|
return $this->assertTrue(strpos(strtolower(decode_entities($haystack)), $needle) !== FALSE, $message, $group);
|
|
}
|
|
|
|
/**
|
|
* Asserts that text transformed to lowercase with HTML entities decoded does not contain a given string.
|
|
*
|
|
* Otherwise fails the test with a given message, similar to all the
|
|
* SimpleTest assert* functions.
|
|
*
|
|
* Note that this does not remove nulls, new lines, and other character that
|
|
* could be used to obscure a tag or an attribute name.
|
|
*
|
|
* @param $haystack
|
|
* Text to look in.
|
|
* @param $needle
|
|
* Lowercase, plain text to look for.
|
|
* @param $message
|
|
* Message to display if failed.
|
|
* @param $group
|
|
* The group this message belongs to, defaults to 'Other'.
|
|
* @return
|
|
* TRUE on pass, FALSE on fail.
|
|
*/
|
|
function assertNoNormalized($haystack, $needle, $message = '', $group = 'Other') {
|
|
return $this->assertTrue(strpos(strtolower(decode_entities($haystack)), $needle) === FALSE, $message, $group);
|
|
}
|
|
|
|
/**
|
|
* Helper method to test functions that are intended to escape HTML.
|
|
*
|
|
* @param $function
|
|
* The name of the function to test.
|
|
*/
|
|
function _testEscapedHTML($function) {
|
|
// Define string replacements for the assertion messages.
|
|
$replacements = array('@function' => $function);
|
|
|
|
// Test that characters that have special meaning in XML are changed into
|
|
// entities.
|
|
$f = $function('<>&"');
|
|
$this->assertEqual($f, '<>&"', t('The @function() function correctly filters basic HTML entities.', $replacements));
|
|
|
|
// A single quote can also be used for evil things in some contexts.
|
|
$f = $function('\'');
|
|
$this->assertEqual($f, ''', t('The @function() function correctly filters single quotes.', $replacements));
|
|
|
|
// Test that the filter is not fooled by different evasion techniques.
|
|
$f = $function("\xc2\"");
|
|
$this->assertEqual($f, '', t('The @function() function correctly filters invalid UTF-8.', $replacements));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Tests for filter hook invocation.
|
|
*/
|
|
class FilterHooksTestCase extends DrupalWebTestCase {
|
|
public static function getInfo() {
|
|
return array(
|
|
'name' => 'Filter format hooks',
|
|
'description' => 'Test hooks for text formats insert/update/delete.',
|
|
'group' => 'Filter',
|
|
);
|
|
}
|
|
|
|
function setUp() {
|
|
parent::setUp('block', 'filter_test');
|
|
$admin_user = $this->drupalCreateUser(array('administer filters', 'administer blocks'));
|
|
$this->drupalLogin($admin_user);
|
|
}
|
|
|
|
/**
|
|
* Test that hooks run correctly on creating, editing, and deleting a text format.
|
|
*/
|
|
function testFilterHooks() {
|
|
// Add a text format.
|
|
$name = $this->randomName();
|
|
$edit = array();
|
|
$edit['name'] = $name;
|
|
$edit['roles[1]'] = 1;
|
|
$this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));
|
|
$this->assertRaw(t('Added text format %format.', array('%format' => $name)), t('New format created.'));
|
|
$this->assertText('hook_filter_format_insert invoked.', t('hook_filter_format_insert was invoked.'));
|
|
|
|
$format_id = db_query("SELECT format FROM {filter_format} WHERE name = :name", array(':name' => $name))->fetchField();
|
|
|
|
// Update text format.
|
|
$edit = array();
|
|
$edit['roles[2]'] = 1;
|
|
$this->drupalPost('admin/config/content/formats/' . $format_id, $edit, t('Save configuration'));
|
|
$this->assertRaw(t('The text format %format has been updated.', array('%format' => $name)), t('Format successfully updated.'));
|
|
$this->assertText('hook_filter_format_update invoked.', t('hook_filter_format_update() was invoked.'));
|
|
|
|
// Add a new custom block.
|
|
$custom_block = array();
|
|
$custom_block['info'] = $this->randomName(8);
|
|
$custom_block['title'] = $this->randomName(8);
|
|
$custom_block['body[value]'] = $this->randomName(32);
|
|
// Use the format created.
|
|
$custom_block['body[format]'] = $format_id;
|
|
$this->drupalPost('admin/structure/block/add', $custom_block, t('Save block'));
|
|
$this->assertText(t('The block has been created.'), t('New block successfully created.'));
|
|
|
|
// Verify the new block is in the database.
|
|
$bid = db_query("SELECT bid FROM {block_custom} WHERE info = :info", array(':info' => $custom_block['info']))->fetchField();
|
|
$this->assertNotNull($bid, t('New block found in database'));
|
|
|
|
// Delete the text format.
|
|
$this->drupalPost('admin/config/content/formats/' . $format_id . '/delete', array(), t('Delete'));
|
|
$this->assertRaw(t('Deleted text format %format.', array('%format' => $name)), t('Format successfully deleted.'));
|
|
$this->assertText('hook_filter_format_delete invoked.', t('hook_filter_format_delete() was invoked.'));
|
|
|
|
// Verify that the deleted format was replaced with the fallback format.
|
|
$current_format = db_select('block_custom', 'b')
|
|
->fields('b', array('format'))
|
|
->condition('bid', $bid)
|
|
->execute()
|
|
->fetchField();
|
|
$this->assertEqual($current_format, filter_fallback_format(), t('Deleted text format replaced with the fallback format.'));
|
|
}
|
|
}
|
|
|