js-xss/test/test_custom_method.js

/**
 * tests for custom method
 *
 * @author Zongmin Lei<leizongmin@gmail.com>
 */

var assert = require("assert");
var xss = require("../");
var debug = require("debug")("xss:test");

describe("test custom XSS method", function() {
  it("#onTag - match tag", function() {
    var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
    var i = 0;
    var html = xss(source, {
      onTag: function(tag, html, options) {
        debug(arguments);
        i++;
        if (i === 1) {
          assert.equal(tag, "a");
          assert.equal(html, '<a href="#">');
          assert.equal(options.isClosing, false);
          assert.equal(options.position, 2);
          assert.equal(options.sourcePosition, 2);
          assert.equal(options.isWhite, true);
        } else if (i === 2) {
          assert.equal(tag, "b");
          assert.equal(html, "<b>");
          assert.equal(options.isClosing, false);
          assert.equal(options.position, 14);
          assert.equal(options.sourcePosition, 14);
          assert.equal(options.isWhite, true);
        } else if (i === 3) {
          assert.equal(tag, "c");
          assert.equal(html, "<c>");
          assert.equal(options.isClosing, false);
          assert.equal(options.position, 17);
          assert.equal(options.sourcePosition, 17);
          assert.equal(options.isWhite, false);
        } else if (i === 4) {
          assert.equal(tag, "c");
          assert.equal(html, "</c>");
          assert.equal(options.isClosing, true);
          assert.equal(options.position, 30);
          assert.equal(options.sourcePosition, 24);
          assert.equal(options.isWhite, false);
        } else if (i === 5) {
          assert.equal(tag, "b");
          assert.equal(html, "</b>");
          assert.equal(options.isClosing, true);
          assert.equal(options.position, 40);
          assert.equal(options.sourcePosition, 28);
          assert.equal(options.isWhite, true);
        } else if (i === 6) {
          assert.equal(tag, "a");
          assert.equal(html, "</a>");
          assert.equal(options.isClosing, true);
          assert.equal(options.position, 44);
          assert.equal(options.sourcePosition, 32);
          assert.equal(options.isWhite, true);
        } else if (i === 7) {
          assert.equal(tag, "br");
          assert.equal(html, "<br>");
          assert.equal(options.isClosing, false);
          assert.equal(options.position, 48);
          assert.equal(options.sourcePosition, 36);
          assert.equal(options.isWhite, true);
        } else {
          throw new Error();
        }
      }
    });
    debug(html);
    assert.equal(
      html,
      'dd<a href="#"><b>&lt;c&gt;haha&lt;/c&gt;</b></a><br>ff'
    );
  });

  it("#onTag - return new html", function() {
    var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
    var i = 0;
    var html = xss(source, {
      onTag: function(tag, html, options) {
        debug(html);
        return html;
      }
    });
    debug(html);
    assert.equal(html, source);
  });

  it("#onIgnoreTag - match tag", function() {
    var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
    var i = 0;
    var html = xss(source, {
      onIgnoreTag: function(tag, html, options) {
        debug(arguments);
        i++;
        if (i === 1) {
          assert.equal(tag, "c");
          assert.equal(html, "<c>");
          assert.equal(options.isClosing, false);
          assert.equal(options.position, 17);
          assert.equal(options.sourcePosition, 17);
          assert.equal(options.isWhite, false);
        } else if (i === 2) {
          assert.equal(tag, "c");
          assert.equal(html, "</c>");
          assert.equal(options.isClosing, true);
          assert.equal(options.position, 30);
          assert.equal(options.sourcePosition, 24);
          assert.equal(options.isWhite, false);
        } else {
          throw new Error();
        }
      }
    });
    debug(html);
    assert.equal(
      html,
      'dd<a href="#"><b>&lt;c&gt;haha&lt;/c&gt;</b></a><br>ff'
    );
  });

  it("#onIgnoreTag - return new html", function() {
    var source = 'dd<a href="#"><b><c>haha</c></b></a><br>ff';
    var i = 0;
    var html = xss(source, {
      onIgnoreTag: function(tag, html, options) {
        debug(html);
        return "[" + (options.isClosing ? "/" : "") + "removed]";
      }
    });
    debug(html);
    assert.equal(
      html,
      'dd<a href="#"><b>[removed]haha[/removed]</b></a><br>ff'
    );
  });

  it("#onTagAttr - match attr", function() {
    var source =
      '<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
    var i = 0;
    var html = xss(source, {
      onTagAttr: function(tag, name, value, isWhiteAttr) {
        debug(arguments);
        assert.equal(tag, "a");
        i++;
        if (i === 1) {
          assert.equal(name, "href");
          assert.equal(value, "#");
          assert.equal(isWhiteAttr, true);
        } else if (i === 2) {
          assert.equal(name, "target");
          assert.equal(value, "_blank");
          assert.equal(isWhiteAttr, true);
        } else if (i === 3) {
          assert.equal(name, "checked");
          assert.equal(value, "");
          assert.equal(isWhiteAttr, false);
        } else if (i === 4) {
          assert.equal(name, "data-a");
          assert.equal(value, "b");
          assert.equal(isWhiteAttr, false);
        } else {
          throw new Error();
        }
      }
    });
    debug(html);
    assert.equal(html, '<a href="#" target="_blank">hi</a>');
  });

  it("#onTagAttr - match attr", function() {
    var source =
      '<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
    var i = 0;
    var html = xss(source, {
      onTagAttr: function(tag, name, value, isWhiteAttr) {
        debug(arguments);
        return "$" + name + "$";
      }
    });
    debug(html);
    assert.equal(html, "<a $href$ $target$ $checked$ $data-a$>hi</a>");
  });

  it("#onIgnoreTagAttr - match attr", function() {
    var source =
      '<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
    var i = 0;
    var html = xss(source, {
      onIgnoreTagAttr: function(tag, name, value, isWhiteAttr) {
        debug(arguments);
        assert.equal(tag, "a");
        i++;
        if (i === 1) {
          assert.equal(name, "checked");
          assert.equal(value, "");
          assert.equal(isWhiteAttr, false);
        } else if (i === 2) {
          assert.equal(name, "data-a");
          assert.equal(value, "b");
          assert.equal(isWhiteAttr, false);
        } else {
          throw new Error();
        }
      }
    });
    debug(html);
    assert.equal(html, '<a href="#" target="_blank">hi</a>');
  });

  it("#onIgnoreTagAttr - match attr", function() {
    var source =
      '<a href="#" target="_blank" checked data-a="b">hi</a href="d">';
    var i = 0;
    var html = xss(source, {
      onIgnoreTagAttr: function(tag, name, value, isWhiteAttr) {
        debug(arguments);
        return "$" + name + "$";
      }
    });
    debug(html);
    assert.equal(html, '<a href="#" target="_blank" $checked$ $data-a$>hi</a>');
  });

  it("#escapeHtml - default", function() {
    var source = "<x>yy</x><a>bb</a>";
    var html = xss(source);
    debug(html);
    assert.equal(html, "&lt;x&gt;yy&lt;/x&gt;<a>bb</a>");
  });

  it("#escapeHtml - return new value", function() {
    var source = "<x>yy</x><a>bb</a>";
    var html = xss(source, {
      escapeHtml: function(str) {
        return str ? "[" + str + "]" : str;
      }
    });
    debug(html);
    assert.equal(html, "[<x>][yy][</x>]<a>[bb]</a>");
  });

  it("#safeAttrValue - default", function() {
    var source = '<a href="javascript:alert(/xss/)" title="hi">link</a>';
    var html = xss(source);
    debug(html);
    assert.equal(html, '<a href title="hi">link</a>');
  });

  it("#safeAttrValue - return new value", function() {
    var source = '<a href="javascript:alert(/xss/)" title="hi">link</a>';
    var html = xss(source, {
      safeAttrValue: function(tag, name, value) {
        debug(arguments);
        assert.equal(tag, "a");
        return "$" + name + "$";
      }
    });
    debug(html);
    assert.equal(html, '<a href="$href$" title="$title$">link</a>');
  });

  it("#stripIgnoreTag", function() {
    var source = "<x>yy</x><a>bb</a>";
    var html = xss(source, {
      stripIgnoreTag: true
    });
    debug(html);
    assert.equal(html, "yy<a>bb</a>");
  });

  it("#stripTagBody - true", function() {
    var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
    var html = xss(source, {
      stripIgnoreTagBody: true
    });
    debug(html);
    assert.equal(html, "<a>link</a>bk");
  });

  it("#stripIgnoreTagBody - *", function() {
    var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
    var html = xss(source, {
      stripIgnoreTagBody: "*"
    });
    debug(html);
    assert.equal(html, "<a>link</a>bk");
  });

  it("#stripIgnoreTagBody - ['x']", function() {
    var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
    var html = xss(source, {
      stripIgnoreTagBody: ["x"]
    });
    debug(html);
    assert.equal(html, "<a>link</a>&lt;y&gt;a&lt;y&gt;&lt;/y&gt;b&lt;/y&gt;k");
  });

  it("#stripIgnoreTagBody - ['x'] & onIgnoreTag", function() {
    var source = "<a>link</a><x>haha</x><y>a<y></y>b</y>k";
    var html = xss(source, {
      stripIgnoreTagBody: ["x"],
      onIgnoreTag: function(tag, html, options) {
        return "$" + tag + "$";
      }
    });
    debug(html);
    assert.equal(html, "<a>link</a>$y$a$y$$y$b$y$k");
  });

  it("#stripIgnoreTag & stripIgnoreTagBody", function() {
    var source = "<scri" + "pt>alert(/xss/);</scri" + "pt>";
    var html = xss(source, {
      stripIgnoreTag: true,
      stripIgnoreTagBody: ["script"]
    });
    debug(html);
    assert.equal(html, "");
  });

  it("#stripIgnoreTag & stripIgnoreTagBody - 2", function() {
    var source = "ooxx<scri" + "pt>alert(/xss/);</scri" + "pt>";
    var html = xss(source, {
      stripIgnoreTag: true,
      stripIgnoreTagBody: ["script"]
    });
    debug(html);
    assert.equal(html, "ooxx");
  });

  it("cssFilter", function() {
    var whiteList = xss.getDefaultWhiteList();
    whiteList.div.push("style");
    assert.equal(
      xss('<div style="width: 50%; vertical-align: top;">hello</div>', {
        whiteList: whiteList
      }),
      '<div style="width:50%;">hello</div>'
    );
    assert.equal(
      xss('<div style="width: 50%; vertical-align: top;">hello</div>', {
        whiteList: whiteList,
        css: false
      }),
      '<div style="width: 50%; vertical-align: top;">hello</div>'
    );
    var css = { whiteList: xss.getDefaultCSSWhiteList() };
    css.whiteList["vertical-align"] = true;
    assert.equal(
      xss('<div style="width: 50%; vertical-align: top;">hello</div>', {
        whiteList: whiteList,
        css: css
      }),
      '<div style="width:50%; vertical-align:top;">hello</div>'
    );
  });

  it("#onTag - sanitize html parameter space", function() {
    var source = '<a target= " href="><script>alert(2)</script>"><span>';
    var i = 0;
    var html = xss(source, {
      onTag: function(_, E, S) {
        if (S.isWhite && "a" === _) {
          if (S.isClosing) return "</span></a>";
          return "".concat(E, '<span>');
        }
      }
    });
    debug(html);
    assert.equal(html, '<a target= " href="><span>&lt;script&gt;alert(2)&lt;/script&gt;"&gt;<span>');
  });

  it("#onTag - sanitize html parameter tab", function() {
    var source = '<a target=	" href="><script>alert(2)</script>"><span>';
    var i = 0;
    var html = xss(source, {
      onTag: function(_, E, S) {
        if (S.isWhite && "a" === _) {
          if (S.isClosing) return "</span></a>";
          return "".concat(E, '<span>');
        }
      }
    });
    debug(html);
    assert.equal(html, '<a target=	" href="><span>&lt;script&gt;alert(2)&lt;/script&gt;"&gt;<span>');
  });
});