107 lines
3.9 KiB
JavaScript
107 lines
3.9 KiB
JavaScript
/**
|
||
* 测试XSS
|
||
*/
|
||
|
||
var assert = require('assert');
|
||
var xss = require('../');
|
||
|
||
|
||
describe('test XSS', function () {
|
||
|
||
it('#normal', function () {
|
||
|
||
// 过滤不在白名单的标签
|
||
assert.equal(xss('<b>abcd</b>'), '<b>abcd</b>');
|
||
assert.equal(xss('<o>abcd</o>'), '<o>abcd</o>');
|
||
assert.equal(xss('<b>abcd</o>'), '<b>abcd</o>');
|
||
assert.equal(xss('<b><o>abcd</b></o>'), '<b><o>abcd</b></o>');
|
||
assert.equal(xss('<hr>'), '<hr>');
|
||
assert.equal(xss('<xss>'), '<xss>');
|
||
assert.equal(xss('<xss o="x">'), '<xss o="x">');
|
||
assert.equal(xss('<a><b>c</b></a>'), '<a><b>c</b></a>');
|
||
assert.equal(xss('<a><c>b</c></a>'), '<a><c>b</c></a>');
|
||
|
||
// 过滤不是标签的<>
|
||
assert.equal(xss('<>>'), '<>>');
|
||
assert.equal(xss('<script>'), '<script>');
|
||
assert.equal(xss('<<a>b>'), '<<a>b>');
|
||
assert.equal(xss('<<<a>>b</a><x>'), '<<<a>>b</a><x>');
|
||
|
||
// 过滤不再白名单中的属性
|
||
assert.equal(xss('<a oo="1" xx="2" href="3">yy</a>'), '<a href="3">yy</a>');
|
||
assert.equal(xss('<a href xx oo>pp</a>'), '<a href>pp</a>');
|
||
assert.equal(xss('<a href "">pp</a>'), '<a href>pp</a>');
|
||
assert.equal(xss('<a t="">'), '<a>');
|
||
|
||
// 属性内的特殊字符
|
||
assert.equal(xss('<a href="\'<<>>">'), '<a href="\'<<>>">');
|
||
assert.equal(xss('<a href=""">'), '<a href=\"\"\">');
|
||
assert.equal(xss('<a h=href="oo">'), '<a>');
|
||
assert.equal(xss('<a h= href="oo">'), '<a href="oo">');
|
||
|
||
// 自动将属性值的单引号转为双引号
|
||
assert.equal(xss('<a href=\'abcd\'>'), '<a href="abcd">');
|
||
assert.equal(xss('<a href=\'"\'>'), '<a href=""e;">');
|
||
|
||
// 没有双引号括起来的属性值
|
||
assert.equal(xss('<a href=home>'), '<a href="home">');
|
||
assert.equal(xss('<a href=home class="b">'), '<a href="home" class="b">');
|
||
assert.equal(xss('<a href=abc("d")>'), '<a href="abc("e;d"e;)">');
|
||
assert.equal(xss('<a href=abc(\'d\')>'), '<a href="abc(\'d\')">');
|
||
|
||
});
|
||
|
||
it('#white list', function () {
|
||
|
||
// 过滤所有标签
|
||
assert.equal(xss('<a href="xx">bb</a>', {}), '<a href="xx">bb</a>');
|
||
assert.equal(xss('<hr>', {}), '<hr>');
|
||
|
||
// 增加白名单标签及属性
|
||
assert.equal(xss('<ooxx yy="ok" cc="no">uu</ooxx>', {ooxx: ['yy']}), '<ooxx yy="ok">uu</ooxx>');
|
||
|
||
});
|
||
|
||
it('#process attribute value', function () {
|
||
|
||
// 过滤指定属性值
|
||
assert.equal(xss('<a href="javascript:ooxx">abc</a>', function (tag, attr, value) {
|
||
if (tag === 'a' && attr === 'href') {
|
||
if (value.substr(0, '11') === 'javascript:') {
|
||
return '#';
|
||
}
|
||
}
|
||
}), '<a href="#">abc</a>');
|
||
|
||
});
|
||
|
||
// XSS攻击测试：https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
|
||
it('#XSS_Filter_Evasion_Cheat_Sheet', function () {
|
||
|
||
assert.equal(xss('></SCRIPT>">\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>'),
|
||
'></SCRIPT>">\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>');
|
||
|
||
assert.equal(xss(';!--"<XSS>=&{()}'), ';!--"<XSS>=&{()}');
|
||
|
||
assert.equal(xss('<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'),
|
||
'<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>');
|
||
|
||
assert.equal(xss('<IMG SRC="javascript:alert(\'XSS\');">'), '<img src="#">');
|
||
|
||
assert.equal(xss('<IMG SRC=javascript:alert(\'XSS\')>'), '<img src="#">');
|
||
|
||
assert.equal(xss('<IMG SRC=JaVaScRiPt:alert(\'XSS\')>'), '<img src="#">');
|
||
|
||
assert.equal(xss('<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>'), '<img src="#">');
|
||
|
||
assert.equal(xss('<IMG """><SCRIPT>alert("XSS")</SCRIPT>">'), '<img>');
|
||
|
||
assert.equal(xss('<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>'), '<img src="#">');
|
||
|
||
assert.equal(xss('<IMG SRC=javascript:alert('XSS')>'),
|
||
'<img src="#">');
|
||
|
||
});
|
||
|
||
});
|