Bugzilla – Attachment 185835 Details for
Bug 39860
Add a way to allow for additional/custom MARC fields in the record display
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39860: Update scrubber profile and add Scrubber.t test
Bug-39860-Update-scrubber-profile-and-add-Scrubber.patch (text/plain), 8.34 KB, created by
Lucas Gass (lukeg)
on 2025-08-27 17:19:16 UTC
(
hide
)
Description:
Bug 39860: Update scrubber profile and add Scrubber.t test
Filename:
MIME Type:
Creator:
Lucas Gass (lukeg)
Created:
2025-08-27 17:19:16 UTC
Size:
8.34 KB
patch
obsolete
>From 45693c24c1c1994ce3887b82876f41354657866d Mon Sep 17 00:00:00 2001 >From: Lucas Gass <lucas@bywatersolutions.com> >Date: Wed, 27 Aug 2025 17:18:26 +0000 >Subject: [PATCH] Bug 39860: Update scrubber profile and add Scrubber.t test > >--- > C4/Scrubber.pm | 39 ++++-------- > t/Scrubber.t | 165 ++++++++++++++++++++++++++++++++++++++++++++++++- > 2 files changed, 176 insertions(+), 28 deletions(-) > >diff --git a/C4/Scrubber.pm b/C4/Scrubber.pm >index ec107993dcc..ca7698a68ba 100644 >--- a/C4/Scrubber.pm >+++ b/C4/Scrubber.pm >@@ -46,29 +46,18 @@ my %scrubbertypes = ( > ], > rules => [ > div => { >- class => qr/^[\w\s\-_]+$/, >- id => qr/^[\w\-_]+$/, >- vocab => qr/^https?:\/\/[\w\.\-\/]+$/, >- typeof => qr/^[\w\s]+$/, >- resource => qr/^[#\w\-_]+$/, >+ class => qr/^[\w\s\-_]+$/, >+ id => qr/^[\w\-_]+$/, > }, > > span => { >- class => qr/^[\w\s\-_]+$/, >- id => qr/^[\w\-_]+$/, >- property => qr/^[\w\s]+$/, >- typeof => qr/^[\w\s]+$/, >- resource => qr/^[#\w\-_]+$/, >- }, >- >- 'h1|h2|h3|h4|h5|h6' => { >- class => qr/^[\w\s\-_]+$/, >- property => qr/^[\w\s]+$/, >+ class => qr/^[\w\s\-_]+$/, >+ id => qr/^[\w\-_]+$/, > }, > > p => { >- class => qr/^[\w\s\-_]+$/, >- property => qr/^[\w\s]+$/, >+ class => qr/^[\w\s\-_]+$/, >+ id => qr/^[\w\-_]+$/, > }, > > a => { >@@ -76,25 +65,21 @@ my %scrubbertypes = ( > class => qr/^[\w\s\-_]+$/, > title => 1, > target => qr/^_(?:blank|self|parent|top)$/, >- rel => >- qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/, >- property => qr/^[\w\s]+$/, >- typeof => qr/^[\w\s]+$/, >- resource => qr/^[#\w\-_]+$/, > }, > >- 'ul|ol' => { >+ ul => { > class => qr/^[\w\s\-_]+$/, >- type => qr/^(?:disc|circle|square|decimal|lower-roman|upper-roman|lower-alpha|upper-alpha|1|a|A|i|I)$/, >+ id => qr/^[\w\-_]+$/, > }, > >- li => { >+ ol => { > class => qr/^[\w\s\-_]+$/, >- value => qr/^\d+$/, >+ id => qr/^[\w\-_]+$/, > }, > >- 'strong|b|em|i|u|s|strike|del|ins|sup|sub' => { >+ li => { > class => qr/^[\w\s\-_]+$/, >+ id => qr/^[\w\-_]+$/, > }, > > i => { >diff --git a/t/Scrubber.t b/t/Scrubber.t >index cf2de7d0f17..d99f51be0a8 100755 >--- a/t/Scrubber.t >+++ b/t/Scrubber.t >@@ -19,7 +19,7 @@ > > use Modern::Perl; > >-use Test::More tests => 7; >+use Test::More tests => 8; > use Test::NoWarnings; > use Test::Exception; > use Test::Warn; >@@ -156,3 +156,166 @@ subtest 'note scrubber functionality' => sub { > unlike( $safe_result, qr/<script>/, 'Script tags are removed from notes' ); > unlike( $safe_result, qr/<iframe>/, 'Iframe tags are removed from notes' ); > }; >+ >+subtest 'record_display profile tests' => sub { >+ plan tests => 26; >+ >+ my $scrubber = C4::Scrubber->new('record_display'); >+ >+ # Test basic allowed elements >+ is( >+ $scrubber->scrub('<div>Koha is awesome!</div>'), >+ '<div>Koha is awesome!</div>', >+ 'div element allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<span class="highlight">Perl is awesome!</span>'), >+ '<span class="highlight">Perl is awesome!</span>', >+ 'span with class allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<p id="lukeG">lukeG</p>'), >+ '<p id="lukeG">lukeG</p>', >+ 'p with id allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<h1>Title</h1><h2>Subtitle</h2>'), >+ '<h1>Title</h1><h2>Subtitle</h2>', >+ 'heading elements allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<ul class="list-style" id="mylist"><li>Item</li></ul>'), >+ '<ul class="list-style" id="mylist"><li>Item</li></ul>', >+ 'ul with class and id attributes allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<ol class="numbered" id="ordered-list"><li class="item">Item</li></ol>'), >+ '<ol class="numbered" id="ordered-list"><li class="item">Item</li></ol>', >+ 'ol with class and id, li with class allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<a href="https://example.com" target="_blank" title="External">Link</a>'), >+ '<a href="https://example.com" target="_blank" title="External">Link</a>', >+ 'https links with attributes allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<a href="/cgi-bin/koha/script.pl">Internal</a>'), >+ '<a href="/cgi-bin/koha/script.pl">Internal</a>', >+ 'internal cgi-bin links allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<a href="mailto:test@example.com">Email</a>'), >+ '<a href="mailto:test@example.com">Email</a>', >+ 'mailto links allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<a href="#anchor">Anchor</a>'), >+ '<a href="#anchor">Anchor</a>', >+ 'anchor links allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<strong>Bold</strong> <em>Italic</em> <u>Underline</u>'), >+ '<strong>Bold</strong> <em>Italic</em> <u>Underline</u>', >+ 'text formatting elements allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<table><thead><tr><th>Header</th></tr></thead><tbody><tr><td>Data</td></tr></tbody></table>'), >+ '<table><thead><tr><th>Header</th></tr></thead><tbody><tr><td>Data</td></tr></tbody></table>', >+ 'table elements allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<pre><code>var x = 1;</code></pre>'), >+ '<pre><code>var x = 1;</code></pre>', >+ 'code formatting elements allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<i class="fa fa-book" aria-label="Book icon"></i>'), >+ '<i class="fa fa-book" aria-label="Book icon"></i>', >+ 'Font awesome is allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<script>alert("xss")</script><div>Safe content</div>'), >+ '<div>Safe content</div>', >+ 'script tags removed while safe content preserved' >+ ); >+ >+ is( >+ $scrubber->scrub('<div onclick="evil()" class="safe">Content</div>'), >+ '<div class="safe">Content</div>', >+ 'onclick handler is removed, class is preserved' >+ ); >+ >+ is( >+ $scrubber->scrub('<div class="valid-class_name">Test</div>'), >+ '<div class="valid-class_name">Test</div>', >+ 'valid class with hyphens and underscores allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<span class="multiple valid classes">Test</span>'), >+ '<span class="multiple valid classes">Test</span>', >+ 'multiple valid classes allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<div class="freak@rico">Test</div>'), >+ '<div>Test</div>', >+ 'invalid class with special characters removed' >+ ); >+ >+ is( >+ $scrubber->scrub('<span class="koha.is.cool">Koha is cool</span>'), >+ '<span>Koha is cool</span>', >+ 'class with dots removed' >+ ); >+ >+ is( >+ $scrubber->scrub('<p id="valid_id-123">Test</p>'), >+ '<p id="valid_id-123">Test</p>', >+ 'valid id with underscores, hyphens, and numbers allowed' >+ ); >+ >+ is( >+ $scrubber->scrub('<p id="invalid id with spaces">Test</p>'), >+ '<p>Test</p>', >+ 'id with spaces removed' >+ ); >+ >+ is( >+ $scrubber->scrub('<div id="rico@freak">Test</div>'), >+ '<div>Test</div>', >+ 'id with special characters removed' >+ ); >+ >+ is( >+ $scrubber->scrub('<a href="javascript:alert(1)">Bad actor link</a>'), >+ '<a>Bad actor link</a>', >+ 'javascript href removed' >+ ); >+ >+ is( >+ $scrubber->scrub('<ol class="roman-numerals" id="list1"><li>Roman numeral list</li></ol>'), >+ '<ol class="roman-numerals" id="list1"><li>Roman numeral list</li></ol>', >+ 'ordered list with class and id attributes' >+ ); >+ >+ is( >+ $scrubber->scrub('<ul class="invalid@class"><li>Bad class</li></ul>'), >+ '<ul><li>Bad class</li></ul>', >+ 'invalid list class attribute removed' >+ ); >+}; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39860
:
182054
|
182055
|
182056
|
182057
|
182058
|
182059
|
182230
|
182231
|
182232
|
182233
|
183007
|
183008
|
183009
|
183010
|
183011
|
183035
|
183077
|
183095
|
183774
|
185835
|
185865
|
185866
|
185867
|
185868
|
185869
|
185870
|
185900
|
185901
|
185902
|
185903
|
185904
|
185905