View | Details | Raw Unified | Return to bug 39860
Collapse All | Expand All

(-)a/C4/Scrubber.pm (-27 / +12 lines)
Lines 46-74 my %scrubbertypes = ( Link Here
46
        ],
46
        ],
47
        rules => [
47
        rules => [
48
            div => {
48
            div => {
49
                class    => qr/^[\w\s\-_]+$/,
49
                class => qr/^[\w\s\-_]+$/,
50
                id       => qr/^[\w\-_]+$/,
50
                id    => qr/^[\w\-_]+$/,
51
                vocab    => qr/^https?:\/\/[\w\.\-\/]+$/,
52
                typeof   => qr/^[\w\s]+$/,
53
                resource => qr/^[#\w\-_]+$/,
54
            },
51
            },
55
52
56
            span => {
53
            span => {
57
                class    => qr/^[\w\s\-_]+$/,
54
                class => qr/^[\w\s\-_]+$/,
58
                id       => qr/^[\w\-_]+$/,
55
                id    => qr/^[\w\-_]+$/,
59
                property => qr/^[\w\s]+$/,
60
                typeof   => qr/^[\w\s]+$/,
61
                resource => qr/^[#\w\-_]+$/,
62
            },
63
64
            'h1|h2|h3|h4|h5|h6' => {
65
                class    => qr/^[\w\s\-_]+$/,
66
                property => qr/^[\w\s]+$/,
67
            },
56
            },
68
57
69
            p => {
58
            p => {
70
                class    => qr/^[\w\s\-_]+$/,
59
                class => qr/^[\w\s\-_]+$/,
71
                property => qr/^[\w\s]+$/,
60
                id    => qr/^[\w\-_]+$/,
72
            },
61
            },
73
62
74
            a => {
63
            a => {
Lines 76-100 my %scrubbertypes = ( Link Here
76
                class  => qr/^[\w\s\-_]+$/,
65
                class  => qr/^[\w\s\-_]+$/,
77
                title  => 1,
66
                title  => 1,
78
                target => qr/^_(?:blank|self|parent|top)$/,
67
                target => qr/^_(?:blank|self|parent|top)$/,
79
                rel    =>
80
                    qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/,
81
                property => qr/^[\w\s]+$/,
82
                typeof   => qr/^[\w\s]+$/,
83
                resource => qr/^[#\w\-_]+$/,
84
            },
68
            },
85
69
86
            'ul|ol' => {
70
            ul => {
87
                class => qr/^[\w\s\-_]+$/,
71
                class => qr/^[\w\s\-_]+$/,
88
                type  => qr/^(?:disc|circle|square|decimal|lower-roman|upper-roman|lower-alpha|upper-alpha|1|a|A|i|I)$/,
72
                id    => qr/^[\w\-_]+$/,
89
            },
73
            },
90
74
91
            li => {
75
            ol => {
92
                class => qr/^[\w\s\-_]+$/,
76
                class => qr/^[\w\s\-_]+$/,
93
                value => qr/^\d+$/,
77
                id    => qr/^[\w\-_]+$/,
94
            },
78
            },
95
79
96
            'strong|b|em|i|u|s|strike|del|ins|sup|sub' => {
80
            li => {
97
                class => qr/^[\w\s\-_]+$/,
81
                class => qr/^[\w\s\-_]+$/,
82
                id    => qr/^[\w\-_]+$/,
98
            },
83
            },
99
84
100
            i => {
85
            i => {
(-)a/t/Scrubber.t (-2 / +164 lines)
Lines 19-25 Link Here
19
19
20
use Modern::Perl;
20
use Modern::Perl;
21
21
22
use Test::More tests => 7;
22
use Test::More tests => 8;
23
use Test::NoWarnings;
23
use Test::NoWarnings;
24
use Test::Exception;
24
use Test::Exception;
25
use Test::Warn;
25
use Test::Warn;
Lines 156-158 subtest 'note scrubber functionality' => sub { Link Here
156
    unlike( $safe_result, qr/<script>/, 'Script tags are removed from notes' );
156
    unlike( $safe_result, qr/<script>/, 'Script tags are removed from notes' );
157
    unlike( $safe_result, qr/<iframe>/, 'Iframe tags are removed from notes' );
157
    unlike( $safe_result, qr/<iframe>/, 'Iframe tags are removed from notes' );
158
};
158
};
159
- 
159
160
subtest 'record_display profile tests' => sub {
161
    plan tests => 26;
162
163
    my $scrubber = C4::Scrubber->new('record_display');
164
165
    # Test basic allowed elements
166
    is(
167
        $scrubber->scrub('<div>Koha is awesome!</div>'),
168
        '<div>Koha is awesome!</div>',
169
        'div element allowed'
170
    );
171
172
    is(
173
        $scrubber->scrub('<span class="highlight">Perl is awesome!</span>'),
174
        '<span class="highlight">Perl is awesome!</span>',
175
        'span with class allowed'
176
    );
177
178
    is(
179
        $scrubber->scrub('<p id="lukeG">lukeG</p>'),
180
        '<p id="lukeG">lukeG</p>',
181
        'p with id allowed'
182
    );
183
184
    is(
185
        $scrubber->scrub('<h1>Title</h1><h2>Subtitle</h2>'),
186
        '<h1>Title</h1><h2>Subtitle</h2>',
187
        'heading elements allowed'
188
    );
189
190
    is(
191
        $scrubber->scrub('<ul class="list-style" id="mylist"><li>Item</li></ul>'),
192
        '<ul class="list-style" id="mylist"><li>Item</li></ul>',
193
        'ul with class and id attributes allowed'
194
    );
195
196
    is(
197
        $scrubber->scrub('<ol class="numbered" id="ordered-list"><li class="item">Item</li></ol>'),
198
        '<ol class="numbered" id="ordered-list"><li class="item">Item</li></ol>',
199
        'ol with class and id, li with class allowed'
200
    );
201
202
    is(
203
        $scrubber->scrub('<a href="https://example.com" target="_blank" title="External">Link</a>'),
204
        '<a href="https://example.com" target="_blank" title="External">Link</a>',
205
        'https links with attributes allowed'
206
    );
207
208
    is(
209
        $scrubber->scrub('<a href="/cgi-bin/koha/script.pl">Internal</a>'),
210
        '<a href="/cgi-bin/koha/script.pl">Internal</a>',
211
        'internal cgi-bin links allowed'
212
    );
213
214
    is(
215
        $scrubber->scrub('<a href="mailto:test@example.com">Email</a>'),
216
        '<a href="mailto:test@example.com">Email</a>',
217
        'mailto links allowed'
218
    );
219
220
    is(
221
        $scrubber->scrub('<a href="#anchor">Anchor</a>'),
222
        '<a href="#anchor">Anchor</a>',
223
        'anchor links allowed'
224
    );
225
226
    is(
227
        $scrubber->scrub('<strong>Bold</strong> <em>Italic</em> <u>Underline</u>'),
228
        '<strong>Bold</strong> <em>Italic</em> <u>Underline</u>',
229
        'text formatting elements allowed'
230
    );
231
232
    is(
233
        $scrubber->scrub('<table><thead><tr><th>Header</th></tr></thead><tbody><tr><td>Data</td></tr></tbody></table>'),
234
        '<table><thead><tr><th>Header</th></tr></thead><tbody><tr><td>Data</td></tr></tbody></table>',
235
        'table elements allowed'
236
    );
237
238
    is(
239
        $scrubber->scrub('<pre><code>var x = 1;</code></pre>'),
240
        '<pre><code>var x = 1;</code></pre>',
241
        'code formatting elements allowed'
242
    );
243
244
    is(
245
        $scrubber->scrub('<i class="fa fa-book" aria-label="Book icon"></i>'),
246
        '<i class="fa fa-book" aria-label="Book icon"></i>',
247
        'Font awesome is allowed'
248
    );
249
250
    is(
251
        $scrubber->scrub('<script>alert("xss")</script><div>Safe content</div>'),
252
        '<div>Safe content</div>',
253
        'script tags removed while safe content preserved'
254
    );
255
256
    is(
257
        $scrubber->scrub('<div onclick="evil()" class="safe">Content</div>'),
258
        '<div class="safe">Content</div>',
259
        'onclick handler is removed, class is preserved'
260
    );
261
262
    is(
263
        $scrubber->scrub('<div class="valid-class_name">Test</div>'),
264
        '<div class="valid-class_name">Test</div>',
265
        'valid class with hyphens and underscores allowed'
266
    );
267
268
    is(
269
        $scrubber->scrub('<span class="multiple valid classes">Test</span>'),
270
        '<span class="multiple valid classes">Test</span>',
271
        'multiple valid classes allowed'
272
    );
273
274
    is(
275
        $scrubber->scrub('<div class="freak@rico">Test</div>'),
276
        '<div>Test</div>',
277
        'invalid class with special characters removed'
278
    );
279
280
    is(
281
        $scrubber->scrub('<span class="koha.is.cool">Koha is cool</span>'),
282
        '<span>Koha is cool</span>',
283
        'class with dots removed'
284
    );
285
286
    is(
287
        $scrubber->scrub('<p id="valid_id-123">Test</p>'),
288
        '<p id="valid_id-123">Test</p>',
289
        'valid id with underscores, hyphens, and numbers allowed'
290
    );
291
292
    is(
293
        $scrubber->scrub('<p id="invalid id with spaces">Test</p>'),
294
        '<p>Test</p>',
295
        'id with spaces removed'
296
    );
297
298
    is(
299
        $scrubber->scrub('<div id="rico@freak">Test</div>'),
300
        '<div>Test</div>',
301
        'id with special characters removed'
302
    );
303
304
    is(
305
        $scrubber->scrub('<a href="javascript:alert(1)">Bad actor link</a>'),
306
        '<a>Bad actor link</a>',
307
        'javascript href removed'
308
    );
309
310
    is(
311
        $scrubber->scrub('<ol class="roman-numerals" id="list1"><li>Roman numeral list</li></ol>'),
312
        '<ol class="roman-numerals" id="list1"><li>Roman numeral list</li></ol>',
313
        'ordered list with class and id attributes'
314
    );
315
316
    is(
317
        $scrubber->scrub('<ul class="invalid@class"><li>Bad class</li></ul>'),
318
        '<ul><li>Bad class</li></ul>',
319
        'invalid list class attribute removed'
320
    );
321
};

Return to bug 39860