106 lines
3.6 KiB
PHP
106 lines
3.6 KiB
PHP
<?php
|
|
|
|
/**
|
|
* This test is kinda weird, because it doesn't test the full safe object
|
|
* functionality, just a small section of it. Or maybe it's actually the right
|
|
* way.
|
|
*/
|
|
class HTMLPurifier_Injector_SafeObjectTest extends HTMLPurifier_InjectorHarness
|
|
{
|
|
|
|
public function setup()
|
|
{
|
|
parent::setup();
|
|
// there is no AutoFormat.SafeObject directive
|
|
$this->config->set('AutoFormat.Custom', array(new HTMLPurifier_Injector_SafeObject()));
|
|
$this->config->set('HTML.Trusted', true);
|
|
}
|
|
|
|
public function testPreserve()
|
|
{
|
|
$this->assertResult(
|
|
'<b>asdf</b>'
|
|
);
|
|
}
|
|
|
|
public function testRemoveStrayParam()
|
|
{
|
|
$this->assertResult(
|
|
'<param />',
|
|
''
|
|
);
|
|
}
|
|
|
|
public function testEditObjectParam()
|
|
{
|
|
$this->assertResult(
|
|
'<object></object>',
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /></object>'
|
|
);
|
|
}
|
|
|
|
public function testIgnoreStrayParam()
|
|
{
|
|
$this->assertResult(
|
|
'<object><param /></object>',
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /></object>'
|
|
);
|
|
}
|
|
|
|
public function testIgnoreDuplicates()
|
|
{
|
|
$this->assertResult(
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /></object>'
|
|
);
|
|
}
|
|
|
|
public function testIgnoreBogusData()
|
|
{
|
|
$this->assertResult(
|
|
'<object><param name="allowscriptaccess" value="always" /><param name="allowNetworking" value="always" /></object>',
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /></object>'
|
|
);
|
|
}
|
|
|
|
public function testIgnoreInvalidData()
|
|
{
|
|
$this->assertResult(
|
|
'<object><param name="foo" value="bar" /></object>',
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /></object>'
|
|
);
|
|
}
|
|
|
|
public function testKeepValidData()
|
|
{
|
|
$this->assertResult(
|
|
'<object><param name="movie" value="bar" /></object>',
|
|
'<object data="bar"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="bar" /></object>'
|
|
);
|
|
}
|
|
|
|
public function testNested()
|
|
{
|
|
$this->assertResult(
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><object></object></object>',
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /></object></object>'
|
|
);
|
|
}
|
|
|
|
public function testNotActuallyNested()
|
|
{
|
|
$this->assertResult(
|
|
'<object><p><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /></p></object>',
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><p></p></object>'
|
|
);
|
|
}
|
|
|
|
public function testCaseInsensitive()
|
|
{
|
|
$this->assertResult(
|
|
'<object><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="flashVars" value="a" /><param name="FlashVars" value="b" /></object>'
|
|
);
|
|
}
|
|
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|