//define('TEST_DB_FORCE_TYPE','mysql'); // This is to force using mysql driver
//require_once 'PHPUnit/Autoload.php';
if(!defined('NOCSRFCHECK')){
define('NOCSRFCHECK','1');
}
if(!defined('NOTOKENRENEWAL')){
define('NOTOKENRENEWAL','1');
}
if(!defined('NOREQUIREMENU')){
define('NOREQUIREMENU','1');// If there is no menu to show
}
if(!defined('NOREQUIREHTML')){
define('NOREQUIREHTML','1');// If we don't need to load the html.form.class.php
}
if(!defined('NOREQUIREAJAX')){
define('NOREQUIREAJAX','1');
}
if(!defined("NOLOGIN")){
define("NOLOGIN",'1');// If this page is public (can be called outside logged session)
}
if(!defined("NOSESSION")){
define("NOSESSION",'1');
}
require_oncedirname(__FILE__).'/../../htdocs/main.inc.php';// We force include of main.inc.php instead of master.inc.php even if we are in CLI mode because it contains a lot of security components we want to test.
$_GET["param7"]='"c:\this is a path~1\aaan &#x110;" abc<bad>def</bad>';
$_POST["param8a"]="Hacker<svg onload='console.log("123")'";// html tag is not closed so it is not detected as html tag but is still harmfull
$_POST['param8b']='<img src=x onerror=alert(document.location) t=';// this is html obfuscated by non closing tag
$_POST['param8c']='< with space after is ok';
$_POST['param8d']='<abc123 is html to clean';
$_POST['param8e']='<123abc is not html to clean';// other similar case: '<2021-12-12'
$this->assertEquals(trim($_POST["param11"]),$result,'Test an email string with alphawithlgt');
// Test with restricthtml: we must remove html open/close tag and content but not htmlentities (we can decode html entities for ascii chars like n)
$result=GETPOST("param0",'restricthtml');
$resultexpected='A real string with <a href="rrr" title="aa"bb">aaa</a> and " and \' and & inside content';
print__METHOD__." result=".$result."\n";
$this->assertEquals($resultexpected,$result,'Test on param0');
$result=GETPOST("param6",'restricthtml');
print__METHOD__." result for param6=".$result." - before=".$_POST["param6"]."\n";
$this->assertEquals('">',$result);
$result=GETPOST("param7",'restricthtml');
print__METHOD__." result param7 = ".$result."\n";
$this->assertEquals('"c:\this is a path~1\aaan &#x;;;;" abcdef',$result);
$result=GETPOST("param8e",'restricthtml');
print__METHOD__." result param8e = ".$result."\n";
$this->assertEquals('',$result);
$result=GETPOST("param12",'restricthtml');
print__METHOD__." result=".$result."\n";
$this->assertEquals(trim($_POST["param12"]),$result,'Test a string with DOCTYPE and restricthtml');
$result=GETPOST("param13",'restricthtml');
print__METHOD__." result=".$result."\n";
$this->assertEquals('n n > < " <a href=\"alert(document.domain)\">XSS</a>',$result,'Test 13 that HTML entities are decoded with restricthtml, but only for common alpha chars');
$result=GETPOST("param13b",'restricthtml');
print__METHOD__." result=".$result."\n";
$this->assertEquals('n n > < " <a href=\"alert(document.domain)\">XSS</a>',$result,'Test 13b that HTML entities are decoded with restricthtml, but only for common alpha chars');
$result=GETPOST("param14",'restricthtml');
print__METHOD__." result=".$result."\n";
$this->assertEquals("Text with ' encoded with the numeric html entity converted into text entity ' (like when submitted by CKEditor)",$result,'Test 14');
$result=GETPOST("param15",'restricthtml');// param15 = <img onxxxx<=alert(document.domain)> src=>0xbeefed that is a dangerous string
print__METHOD__." result=".$result."\n";
$this->assertEquals("<img onxxxx=alert(document.domain) src=>0xbeefed",$result,'Test 15');// The GETPOST return a harmull string
$result=GETPOST("param15b",'restricthtml');// param15b = <img onerror<=alert(document.domain)> src=>0xbeefed that is a dangerous string
print__METHOD__." result=".$result."\n";
$this->assertEquals("<img alert(document.domain) src=>0xbeefed",$result,'Test 15b');// The GETPOST return a harmull string
//$_POST["param0"] = 'A real string with <a href="rrr" title="aabb">aaa</a> and " inside content';
$result=GETPOST("param0",'restricthtml');
$resultexpected='A real string with <a href="rrr" title=\'aa"bb\'>aaa</a> and " and \' and & inside content';
print__METHOD__." result for param0=".$result."\n";
$this->assertEquals($resultexpected,$result,'Test on param0');
$result=GETPOST("param15b",'restricthtml');// param15b = <img onerror<=alert(document.domain)> src=>0xbeefed that is a dangerous string
print__METHOD__." result for param15b=".$result."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
//$this->assertEquals('<img onerror> src=>0xbeefed', $result, 'Test 15b'); // ... on other PHP and libxml versions, we got a HTML that has been cleaned
print__METHOD__." result for param6=".$result." - before=".$_POST["param6"]."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
//$this->assertEquals('">', $result); // ... on other PHP and libxml versions, we got a HTML that has been cleaned
$result=GETPOST("param7",'restricthtml');// param7 = "c:\this is a path~1\aaan &#x110;" abc<bad>def</bad>
print__METHOD__." result param7 = ".$result."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
//$this->assertEquals('"c:\this is a path~1\aaan 110;" abcdef', $result); // ... on other PHP and libxml versions, we got a HTML that has been cleaned
// Test with restricthtml + MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY only to test disabling of bad attributes
$resultexpected='A real string with <a href="rrr" title="aa"bb">aaa</a> and " and \' and & inside content';
print__METHOD__." result for param0=".$result."\n";
$this->assertEquals($resultexpected,$result,'Test on param0');
$result=GETPOST("param15b",'restricthtml');// param15b = <img onerror<=alert(document.domain)> src=>0xbeefed that is a dangerous string
print__METHOD__." result for param15b=".$result."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
//$this->assertEquals('<img onerror> src=>0xbeefed', $result, 'Test 15b'); // ... on other PHP and libxml versions, we got a HTML that has been cleaned
$result=GETPOST("param6",'restricthtml');
print__METHOD__." result for param6=".$result." - before=".$_POST["param6"]."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
$this->assertEquals('">',$result);
$result=GETPOST("param7",'restricthtml');
print__METHOD__." result param7 = ".$result."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
$this->assertEquals('"c:\this is a path~1\aaan &#x110;" abcdef',$result);
}
// Test with restricthtml + MAIN_RESTRICTHTML_ONLY_VALID_HTML + MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY to test disabling of bad attributes
$resultexpected='A real string with <a href="rrr" title=\'aa"bb\'>aaa</a> and " and \' and & inside content';
print__METHOD__." result for param0=".$result."\n";
$this->assertEquals($resultexpected,$result,'Test on param0');
$result=GETPOST("param15b",'restricthtml');// param15b = <img onerror<=alert(document.domain)> src=>0xbeefed that is a dangerous string
print__METHOD__." result=".$result."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
//$this->assertEquals('<img onerror> src=>0xbeefed', $result, 'Test 15b'); // ... on other PHP and libxml versions, we got a HTML that has been cleaned
$result=GETPOST("param6",'restricthtml');
print__METHOD__." result for param6=".$result." - before=".$_POST["param6"]."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
$this->assertEquals('">',$result);
$result=GETPOST("param7",'restricthtml');
print__METHOD__." result param7 = ".$result."\n";
//$this->assertEquals('InvalidHTMLStringCantBeCleaned', $result, 'Test 15b'); // With some PHP and libxml version, we got this result when parsing invalid HTML, but ...
$this->assertEquals('"c:\this is a path~1\aaan 110;" abcdef',$result);
}
// Test with restricthtml + MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES to test disabling of bad attributes
$this->assertEquals('<img src="data:abc"><img src="bbb"><img src="/ccc"><span style="background: url(/ddd)"></span>',$result,'Test on limit on GETPOST fails');
$this->assertEquals('<img src="data:abc"><img src="bbb"><img src="/ccc"><span style="background: url(/ddd)"></span>',$result,'Test on MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = 1 (links on data or relative links ar allowed)');
// Test that links not on wrapper and not data are disallowed
