diff options
author | Andrey Andreev <narf@devilix.net> | 2015-10-27 11:30:18 +0100 |
---|---|---|
committer | Andrey Andreev <narf@devilix.net> | 2015-10-31 17:54:48 +0100 |
commit | 71b1b3f5b2dcc0f4b652e9494e9853b82541ac8c (patch) | |
tree | a3d526ce9626b6061d7ce9c6cda8b91dbe118efd /tests/codeigniter/core | |
parent | 3368cebeb6682013c44be7a03d3b3dac0f5c8973 (diff) |
Harden xss_clean()
Diffstat (limited to 'tests/codeigniter/core')
-rw-r--r-- | tests/codeigniter/core/Security_test.php | 35 |
1 files changed, 20 insertions, 15 deletions
diff --git a/tests/codeigniter/core/Security_test.php b/tests/codeigniter/core/Security_test.php index 52967dc2f..2ef822863 100644 --- a/tests/codeigniter/core/Security_test.php +++ b/tests/codeigniter/core/Security_test.php @@ -115,7 +115,7 @@ class Security_test extends CI_TestCase { public function test_xss_clean_entity_double_encoded() { $input = '<a href="&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41">Clickhere</a>'; - $this->assertEquals('<a >Clickhere</a>', $this->security->xss_clean($input)); + $this->assertEquals('<a>Clickhere</a>', $this->security->xss_clean($input)); } // -------------------------------------------------------------------- @@ -134,7 +134,7 @@ class Security_test extends CI_TestCase { public function test_xss_clean_js_img_removal() { $input = '<img src="&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41">Clickhere'; - $this->assertEquals('<img >', $this->security->xss_clean($input)); + $this->assertEquals('<img>', $this->security->xss_clean($input)); } // -------------------------------------------------------------------- @@ -146,7 +146,7 @@ class Security_test extends CI_TestCase { $this->assertEquals('<fubar>', $this->security->xss_clean('<fubar>')); $this->assertEquals( - '<img [removed]> src="x">', + '<img svg=""> src="x">', $this->security->xss_clean('<img <svg=""> src="x">') ); @@ -160,21 +160,21 @@ class Security_test extends CI_TestCase { public function test_xss_clean_sanitize_naughty_html_attributes() { - $this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo onAttribute="bar">')); - $this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo onAttributeNoQuotes=bar>')); - $this->assertEquals('<foo [removed]bar>', $this->security->xss_clean('<foo onAttributeWithSpaces = bar>')); + $this->assertEquals('<foo xss=removed>', $this->security->xss_clean('<foo onAttribute="bar">')); + $this->assertEquals('<foo xss=removed>', $this->security->xss_clean('<foo onAttributeNoQuotes=bar>')); + $this->assertEquals('<foo xss=removed>', $this->security->xss_clean('<foo onAttributeWithSpaces = bar>')); $this->assertEquals('<foo prefixOnAttribute="bar">', $this->security->xss_clean('<foo prefixOnAttribute="bar">')); $this->assertEquals('<foo>onOutsideOfTag=test</foo>', $this->security->xss_clean('<foo>onOutsideOfTag=test</foo>')); $this->assertEquals('onNoTagAtAll = true', $this->security->xss_clean('onNoTagAtAll = true')); - $this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo fscommand=case-insensitive>')); - $this->assertEquals('<foo [removed]>', $this->security->xss_clean('<foo seekSegmentTime=whatever>')); + $this->assertEquals('<foo xss=removed>', $this->security->xss_clean('<foo fscommand=case-insensitive>')); + $this->assertEquals('<foo xss=removed>', $this->security->xss_clean('<foo seekSegmentTime=whatever>')); $this->assertEquals( - '<foo bar=">" baz=\'>\' [removed]>', + '<foo bar=">" baz=\'>\' xss=removed>', $this->security->xss_clean('<foo bar=">" baz=\'>\' onAfterGreaterThan="quotes">') ); $this->assertEquals( - '<foo bar=">" baz=\'>\' [removed]>', + '<foo bar=">" baz=\'>\' xss=removed>', $this->security->xss_clean('<foo bar=">" baz=\'>\' onAfterGreaterThan=noQuotes>') ); @@ -194,7 +194,7 @@ class Security_test extends CI_TestCase { ); $this->assertEquals( - '<a [removed]>', + '<a xss=removed>', $this->security->xss_clean('<a< onmouseover="alert(1)">') ); @@ -204,19 +204,24 @@ class Security_test extends CI_TestCase { ); $this->assertEquals( - '<image src="<>" [removed]>', + '<image src="<>" xss=removed>', $this->security->xss_clean('<image src="<>" onerror=\'alert(1)\'>') ); $this->assertEquals( - '<b [removed] [removed]>', + '<b xss=removed>', $this->security->xss_clean('<b "=<= onmouseover=alert(1)>') ); $this->assertEquals( - '<b [removed] [removed]alert(1),1>1">', + '<b xss=removed xss=removed>1">', $this->security->xss_clean('<b a=<=" onmouseover="alert(1),1>1">') ); + + $this->assertEquals( + '<b x=" onmouseover=alert(1)//">', + $this->security->xss_clean('<b "="< x=" onmouseover=alert(1)//">') + ); } // -------------------------------------------------------------------- @@ -228,7 +233,7 @@ class Security_test extends CI_TestCase { public function test_naughty_html_plus_evil_attributes() { $this->assertEquals( - '<svg<img > src="x" [removed]>', + '<svg<img src="x" xss=removed>', $this->security->xss_clean('<svg<img > src="x" onerror="location=/javascript/.source+/:alert/.source+/(1)/.source">') ); } |