logo

pleroma

My custom branche(s) on git.pleroma.social/pleroma/pleroma git clone https://anongit.hacktivis.me/git/pleroma.git/

html_test.exs (9802B)

    

  1. # Pleroma: A lightweight social networking server
  2. # Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
  3. # SPDX-License-Identifier: AGPL-3.0-only
  5. defmodule Pleroma.HTMLTest do
  6.   alias Pleroma.HTML
  7.   alias Pleroma.Object
  8.   alias Pleroma.Web.CommonAPI
  9.   use Pleroma.DataCase, async: true
  11.   import Pleroma.Factory
  13.   @html_sample """
  14.     <b>this is in bold</b>
  15.     <p>this is a paragraph</p>
  16.     this is a linebreak<br />
  17.     this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
  18.     this is a link with not allowed "rel" attribute: <a href="http://example.com/" rel="tag noallowed">example.com</a>
  19.     this is an image: <img src="http://example.com/image.jpg"><br />
  20.     this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"><br />
  21.     <script>alert('hacked')</script>
  22.   """
  24.   @html_onerror_sample """
  25.   <img src="http://example.com/image.jpg" onerror="alert('hacked')">
  26.   """
  28.   @html_stillimage_sample """
  29.   <img class="still-image" src="http://example.com/image.jpg">
  30.   """
  32.   @html_span_class_sample """
  33.   <span class="animate-spin">hi</span>
  34.   """
  36.   @html_span_microformats_sample """
  37.   <span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
  38.   """
  40.   @html_span_invalid_microformats_sample """
  41.   <span class="h-card"><a class="u-url mention animate-spin">@<span>foo</span></a></span>
  42.   """
  44.   @mention_hashtags_sample """
  45.   <a href="https://mastodon.example/tags/linux" class="mention hashtag" rel="tag">#<span>linux</span></a>
  46.   """
  48.   describe "StripTags scrubber" do
  49.     test "works as expected" do
  50.       expected = """
  51.         this is in bold
  52.         this is a paragraph
  53.         this is a linebreak
  54.         this is a link with allowed &quot;rel&quot; attribute: example.com
  55.         this is a link with not allowed &quot;rel&quot; attribute: example.com
  56.         this is an image: 
  57.         this is an inline emoji: 
  58.         alert(&#39;hacked&#39;)
  59.       """
  61.       assert expected == HTML.strip_tags(@html_sample)
  62.     end
  64.     test "does not allow attribute-based XSS" do
  65.       expected = "\n"
  67.       assert expected == HTML.strip_tags(@html_onerror_sample)
  68.     end
  69.   end
  71.   describe "TwitterText scrubber" do
  72.     test "normalizes HTML as expected" do
  73.       expected = """
  74.         this is in bold
  75.         <p>this is a paragraph</p>
  76.         this is a linebreak<br/>
  77.         this is a link with allowed &quot;rel&quot; attribute: <a href="http://example.com/" rel="tag">example.com</a>
  78.         this is a link with not allowed &quot;rel&quot; attribute: <a href="http://example.com/">example.com</a>
  79.         this is an image: <img src="http://example.com/image.jpg"/><br/>
  80.         this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"/><br/>
  81.         alert(&#39;hacked&#39;)
  82.       """
  84.       assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.TwitterText)
  85.     end
  87.     test "does not allow attribute-based XSS" do
  88.       expected = """
  89.       <img src="http://example.com/image.jpg"/>
  90.       """
  92.       assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.TwitterText)
  93.     end
  95.     test "does not allow spans with invalid classes" do
  96.       expected = """
  97.       <span>hi</span>
  98.       """
  100.       assert expected ==
  101.                HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.TwitterText)
  102.     end
  104.     test "does not allow images with invalid classes" do
  105.       expected = """
  106.       <img src="http://example.com/image.jpg"/>
  107.       """
  109.       assert expected ==
  110.                HTML.filter_tags(@html_stillimage_sample, Pleroma.HTML.Scrubber.TwitterText)
  111.     end
  113.     test "does allow microformats" do
  114.       expected = """
  115.       <span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
  116.       """
  118.       assert expected ==
  119.                HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.TwitterText)
  120.     end
  122.     test "filters invalid microformats markup" do
  123.       expected = """
  124.       <span class="h-card"><a>@<span>foo</span></a></span>
  125.       """
  127.       assert expected ==
  128.                HTML.filter_tags(
  129.                  @html_span_invalid_microformats_sample,
  130.                  Pleroma.HTML.Scrubber.TwitterText
  131.                )
  132.     end
  134.     test "does allow mention hashtags" do
  135.       expected = """
  136.       <a href="https://mastodon.example/tags/linux" class="mention hashtag" rel="tag">#<span>linux</span></a>
  137.       """
  139.       assert expected ==
  140.                HTML.filter_tags(@mention_hashtags_sample, Pleroma.HTML.Scrubber.Default)
  141.     end
  142.   end
  144.   describe "default scrubber" do
  145.     test "normalizes HTML as expected" do
  146.       expected = """
  147.         <b>this is in bold</b>
  148.         <p>this is a paragraph</p>
  149.         this is a linebreak<br/>
  150.         this is a link with allowed &quot;rel&quot; attribute: <a href="http://example.com/" rel="tag">example.com</a>
  151.         this is a link with not allowed &quot;rel&quot; attribute: <a href="http://example.com/">example.com</a>
  152.         this is an image: <img src="http://example.com/image.jpg"/><br/>
  153.         this is an inline emoji: <img class="emoji" src="http://example.com/image.jpg"/><br/>
  154.         alert(&#39;hacked&#39;)
  155.       """
  157.       assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.Default)
  158.     end
  160.     test "does not allow attribute-based XSS" do
  161.       expected = """
  162.       <img src="http://example.com/image.jpg"/>
  163.       """
  165.       assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.Default)
  166.     end
  168.     test "does not allow spans with invalid classes" do
  169.       expected = """
  170.       <span>hi</span>
  171.       """
  173.       assert expected == HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.Default)
  174.     end
  176.     test "does not allow images with invalid classes" do
  177.       expected = """
  178.       <img src="http://example.com/image.jpg"/>
  179.       """
  181.       assert expected ==
  182.                HTML.filter_tags(@html_stillimage_sample, Pleroma.HTML.Scrubber.TwitterText)
  183.     end
  185.     test "does allow microformats" do
  186.       expected = """
  187.       <span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
  188.       """
  190.       assert expected ==
  191.                HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.Default)
  192.     end
  194.     test "filters invalid microformats markup" do
  195.       expected = """
  196.       <span class="h-card"><a>@<span>foo</span></a></span>
  197.       """
  199.       assert expected ==
  200.                HTML.filter_tags(
  201.                  @html_span_invalid_microformats_sample,
  202.                  Pleroma.HTML.Scrubber.Default
  203.                )
  204.     end
  206.     test "does allow mention hashtags" do
  207.       expected = """
  208.       <a href="https://mastodon.example/tags/linux" class="mention hashtag" rel="tag">#<span>linux</span></a>
  209.       """
  211.       assert expected ==
  212.                HTML.filter_tags(@mention_hashtags_sample, Pleroma.HTML.Scrubber.Default)
  213.     end
  214.   end
  216.   describe "extract_first_external_url_from_object" do
  217.     test "extracts the url" do
  218.       user = insert(:user)
  220.       {:ok, activity} =
  221.         CommonAPI.post(user, %{
  222.           status:
  223.             "I think I just found the best github repo https://github.com/komeiji-satori/Dress"
  224.         })
  226.       object = Object.normalize(activity, fetch: false)
  227.       url = HTML.extract_first_external_url_from_object(object)
  228.       assert url == "https://github.com/komeiji-satori/Dress"
  229.     end
  231.     test "skips mentions" do
  232.       user = insert(:user)
  233.       other_user = insert(:user)
  235.       {:ok, activity} =
  236.         CommonAPI.post(user, %{
  237.           status:
  238.             "@#{other_user.nickname} install misskey! https://github.com/syuilo/misskey/blob/develop/docs/setup.en.md"
  239.         })
  241.       object = Object.normalize(activity, fetch: false)
  242.       url = HTML.extract_first_external_url_from_object(object)
  244.       assert url == "https://github.com/syuilo/misskey/blob/develop/docs/setup.en.md"
  246.       refute url == other_user.ap_id
  247.     end
  249.     test "skips hashtags" do
  250.       user = insert(:user)
  252.       {:ok, activity} =
  253.         CommonAPI.post(user, %{
  254.           status: "#cofe https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
  255.         })
  257.       object = Object.normalize(activity, fetch: false)
  258.       url = HTML.extract_first_external_url_from_object(object)
  260.       assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
  261.     end
  263.     test "skips microformats hashtags" do
  264.       user = insert(:user)
  266.       {:ok, activity} =
  267.         CommonAPI.post(user, %{
  268.           status:
  269.             "<a href=\"https://pleroma.gov/tags/cofe\" rel=\"tag\">#cofe</a> https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140",
  270.           content_type: "text/html"
  271.         })
  273.       object = Object.normalize(activity, fetch: false)
  274.       url = HTML.extract_first_external_url_from_object(object)
  276.       assert url == "https://www.pixiv.net/member_illust.php?mode=medium&illust_id=72255140"
  277.     end
  279.     test "does not crash when there is an HTML entity in a link" do
  280.       user = insert(:user)
  282.       {:ok, activity} = CommonAPI.post(user, %{status: "\"http://cofe.com/?boomer=ok&foo=bar\""})
  284.       object = Object.normalize(activity, fetch: false)
  286.       assert nil == HTML.extract_first_external_url_from_object(object)
  287.     end
  289.     test "skips attachment links" do
  290.       user = insert(:user)
  292.       {:ok, activity} =
  293.         CommonAPI.post(user, %{
  294.           status:
  295.             "<a href=\"https://pleroma.gov/media/d24caa3a498e21e0298377a9ca0149a4f4f8b767178aacf837542282e2d94fb1.png?name=image.png\" class=\"attachment\">image.png</a>"
  296.         })
  298.       object = Object.normalize(activity, fetch: false)
  300.       assert nil == HTML.extract_first_external_url_from_object(object)
  301.     end
  302.   end
  303. end