gtsocial-umbx

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

sanitize_test.go (4346B)

      1 // GoToSocial
      2 // Copyright (C) GoToSocial Authors admin@gotosocial.org
      3 // SPDX-License-Identifier: AGPL-3.0-or-later
      4 //
      5 // This program is free software: you can redistribute it and/or modify
      6 // it under the terms of the GNU Affero General Public License as published by
      7 // the Free Software Foundation, either version 3 of the License, or
      8 // (at your option) any later version.
      9 //
     10 // This program is distributed in the hope that it will be useful,
     11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
     12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     13 // GNU Affero General Public License for more details.
     14 //
     15 // You should have received a copy of the GNU Affero General Public License
     16 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
     17 
     18 package text_test
     19 
     20 import (
     21 	"testing"
     22 
     23 	"github.com/stretchr/testify/suite"
     24 	"github.com/superseriousbusiness/gotosocial/internal/text"
     25 )
     26 
     27 const (
     28 	sanitizeHTML      = `here's some naughty html: <script>alert(ahhhh)</script> !!!`
     29 	sanitizedHTML     = `here&#39;s some naughty html:  !!!`
     30 	sanitizeOutgoing  = `<p>gotta test some fucking &#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39; marks</p>`
     31 	sanitizedOutgoing = `<p>gotta test some fucking &#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39; marks</p>`
     32 )
     33 
     34 type SanitizeTestSuite struct {
     35 	suite.Suite
     36 }
     37 
     38 func (suite *SanitizeTestSuite) TestSanitizeOutgoing() {
     39 	s := text.SanitizeHTML(sanitizeOutgoing)
     40 	suite.Equal(sanitizedOutgoing, s)
     41 }
     42 
     43 func (suite *SanitizeTestSuite) TestSanitizeHTML() {
     44 	s := text.SanitizeHTML(sanitizeHTML)
     45 	suite.Equal(sanitizedHTML, s)
     46 }
     47 
     48 func (suite *SanitizeTestSuite) TestSanitizeCaption1() {
     49 	dodgyCaption := "<script>console.log('haha!')</script>this is just a normal caption ;)"
     50 	sanitized := text.SanitizePlaintext(dodgyCaption)
     51 	suite.Equal("this is just a normal caption ;)", sanitized)
     52 }
     53 
     54 func (suite *SanitizeTestSuite) TestSanitizeCaption2() {
     55 	dodgyCaption := "<em>here's a LOUD caption</em>"
     56 	sanitized := text.SanitizePlaintext(dodgyCaption)
     57 	suite.Equal("here's a LOUD caption", sanitized)
     58 }
     59 
     60 func (suite *SanitizeTestSuite) TestSanitizeCaption3() {
     61 	dodgyCaption := ""
     62 	sanitized := text.SanitizePlaintext(dodgyCaption)
     63 	suite.Equal("", sanitized)
     64 }
     65 
     66 func (suite *SanitizeTestSuite) TestSanitizeCaption4() {
     67 	dodgyCaption := `
     68 
     69 
     70 here is
     71 a multi line
     72 caption
     73 with some newlines
     74 
     75 
     76 
     77 `
     78 	sanitized := text.SanitizePlaintext(dodgyCaption)
     79 	suite.Equal("here is\na multi line\ncaption\nwith some newlines", sanitized)
     80 }
     81 
     82 func (suite *SanitizeTestSuite) TestSanitizeCaption5() {
     83 	// html-escaped: "<script>console.log('aha!')</script> hello world"
     84 	dodgyCaption := `&lt;script&gt;console.log(&apos;aha!&apos;)&lt;/script&gt; hello world`
     85 	sanitized := text.SanitizePlaintext(dodgyCaption)
     86 	suite.Equal("hello world", sanitized)
     87 }
     88 
     89 func (suite *SanitizeTestSuite) TestSanitizeCaption6() {
     90 	// html-encoded: "<script>console.log('aha!')</script> hello world"
     91 	dodgyCaption := `&lt;&#115;&#99;&#114;&#105;&#112;&#116;&gt;&#99;&#111;&#110;&#115;&#111;&#108;&#101;&period;&#108;&#111;&#103;&lpar;&apos;&#97;&#104;&#97;&excl;&apos;&rpar;&lt;&sol;&#115;&#99;&#114;&#105;&#112;&#116;&gt;&#32;&#104;&#101;&#108;&#108;&#111;&#32;&#119;&#111;&#114;&#108;&#100;`
     92 	sanitized := text.SanitizePlaintext(dodgyCaption)
     93 	suite.Equal("hello world", sanitized)
     94 }
     95 
     96 func (suite *SanitizeTestSuite) TestSanitizeCustomCSS() {
     97 	customCSS := `.toot .username {
     98 	color: var(--link_fg);
     99 	line-height: 2rem;
    100 	margin-top: -0.5rem;
    101 	align-self: start;
    102 	
    103 	white-space: nowrap;
    104 	overflow: hidden;
    105 	text-overflow: ellipsis;
    106 }`
    107 	sanitized := text.SanitizePlaintext(customCSS)
    108 	suite.Equal(customCSS, sanitized) // should be the same as it was before
    109 }
    110 
    111 func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS1() {
    112 	// try to break out of <style> into <head> and change the document title
    113 	customCSS := "</style><title>pee pee poo poo</title><style>"
    114 	sanitized := text.SanitizePlaintext(customCSS)
    115 	suite.Empty(sanitized)
    116 }
    117 
    118 func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS2() {
    119 	// try to break out of <style> into <head> and change the document title
    120 	customCSS := "pee pee poo poo</style><title></title><style>"
    121 	sanitized := text.SanitizePlaintext(customCSS)
    122 	suite.Equal("pee pee poo poo", sanitized)
    123 }
    124 
    125 func TestSanitizeTestSuite(t *testing.T) {
    126 	suite.Run(t, new(SanitizeTestSuite))
    127 }