vendor/rails/actionpack/test/template/sanitize_helper_test.rb

   1 require 'abstract_unit'
   2 require 'testing_sandbox'
   3
   4 # The exhaustive tests are in test/controller/html/sanitizer_test.rb.
   5 # This tests the that the helpers hook up correctly to the sanitizer classes.
   6 class SanitizeHelperTest < ActionView::TestCase
   7   tests ActionView::Helpers::SanitizeHelper
   8   include TestingSandbox
   9
  10   def test_strip_links
  11     assert_equal "Dont touch me", strip_links("Dont touch me")
  12     assert_equal "<a<a", strip_links("<a<a")
  13     assert_equal "on my mind\nall day long", strip_links("<a href='almost'>on my mind</a>\n<A href='almost'>all day long</A>")
  14     assert_equal "0wn3d", strip_links("<a href='http://www.rubyonrails.com/'><a href='http://www.rubyonrails.com/' onlclick='steal()'>0wn3d</a></a>")
  15     assert_equal "Magic", strip_links("<a href='http://www.rubyonrails.com/'>Mag<a href='http://www.ruby-lang.org/'>ic")
  16     assert_equal "FrrFox", strip_links("<href onlclick='steal()'>FrrFox</a></href>")
  17     assert_equal "My mind\nall <b>day</b> long", strip_links("<a href='almost'>My mind</a>\n<A href='almost'>all <b>day</b> long</A>")
  18     assert_equal "all <b>day</b> long", strip_links("<<a>a href='hello'>all <b>day</b> long<</A>/a>")
  19   end
  20
  21   def test_sanitize_form
  22     assert_sanitized "<form action=\"/foo/bar\" method=\"post\"><input></form>", ''
  23   end
  24
  25   def test_should_sanitize_illegal_style_properties
  26     raw      = %(display:block; position:absolute; left:0; top:0; width:100%; height:100%; z-index:1; background-color:black; background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg); background-x:center; background-y:center; background-repeat:repeat;)
  27     expected = %(display: block; width: 100%; height: 100%; background-color: black; background-image: ; background-x: center; background-y: center;)
  28     assert_equal expected, sanitize_css(raw)
  29   end
  30
  31   def test_strip_tags
  32     assert_equal("<<<bad html", strip_tags("<<<bad html"))
  33     assert_equal("<<", strip_tags("<<<bad html>"))
  34     assert_equal("Dont touch me", strip_tags("Dont touch me"))
  35     assert_equal("This is a test.", strip_tags("<p>This <u>is<u> a <a href='test.html'><strong>test</strong></a>.</p>"))
  36     assert_equal("Weirdos", strip_tags("Wei<<a>a onclick='alert(document.cookie);'</a>/>rdos"))
  37     assert_equal("This is a test.", strip_tags("This is a test."))
  38     assert_equal(
  39     %{This is a test.\n\n\nIt no longer contains any HTML.\n}, strip_tags(
  40     %{<title>This is <b>a <a href="" target="_blank">test</a></b>.</title>\n\n<!-- it has a comment -->\n\n<p>It no <b>longer <strong>contains <em>any <strike>HTML</strike></em>.</strong></b></p>\n}))
  41     assert_equal "This has a  here.", strip_tags("This has a <!-- comment --> here.")
  42     [nil, '', '   '].each { |blank| assert_equal blank, strip_tags(blank) }
  43   end
  44
  45   def assert_sanitized(text, expected = nil)
  46     assert_equal((expected || text), sanitize(text))
  47   end
  48 end