From a5cb3648906e42143228c907a53402c44b5febfe Mon Sep 17 00:00:00 2001 From: Lucas Gass Date: Wed, 27 Aug 2025 17:18:26 +0000 Subject: [PATCH] Bug 39860: Update scrubber profile and add Scrubber.t test Signed-off-by: David Cook --- C4/Scrubber.pm | 39 ++--- .../en/xslt/MARC21slim2intranetDetail.xsl | 1 + t/Scrubber.t | 165 +++++++++++++++++- 3 files changed, 177 insertions(+), 28 deletions(-) diff --git a/C4/Scrubber.pm b/C4/Scrubber.pm index ec107993dc..ca7698a68b 100644 --- a/C4/Scrubber.pm +++ b/C4/Scrubber.pm @@ -46,29 +46,18 @@ my %scrubbertypes = ( ], rules => [ div => { - class => qr/^[\w\s\-_]+$/, - id => qr/^[\w\-_]+$/, - vocab => qr/^https?:\/\/[\w\.\-\/]+$/, - typeof => qr/^[\w\s]+$/, - resource => qr/^[#\w\-_]+$/, + class => qr/^[\w\s\-_]+$/, + id => qr/^[\w\-_]+$/, }, span => { - class => qr/^[\w\s\-_]+$/, - id => qr/^[\w\-_]+$/, - property => qr/^[\w\s]+$/, - typeof => qr/^[\w\s]+$/, - resource => qr/^[#\w\-_]+$/, - }, - - 'h1|h2|h3|h4|h5|h6' => { - class => qr/^[\w\s\-_]+$/, - property => qr/^[\w\s]+$/, + class => qr/^[\w\s\-_]+$/, + id => qr/^[\w\-_]+$/, }, p => { - class => qr/^[\w\s\-_]+$/, - property => qr/^[\w\s]+$/, + class => qr/^[\w\s\-_]+$/, + id => qr/^[\w\-_]+$/, }, a => { @@ -76,25 +65,21 @@ my %scrubbertypes = ( class => qr/^[\w\s\-_]+$/, title => 1, target => qr/^_(?:blank|self|parent|top)$/, - rel => - qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/, - property => qr/^[\w\s]+$/, - typeof => qr/^[\w\s]+$/, - resource => qr/^[#\w\-_]+$/, }, - 'ul|ol' => { + ul => { class => qr/^[\w\s\-_]+$/, - type => qr/^(?:disc|circle|square|decimal|lower-roman|upper-roman|lower-alpha|upper-alpha|1|a|A|i|I)$/, + id => qr/^[\w\-_]+$/, }, - li => { + ol => { class => qr/^[\w\s\-_]+$/, - value => qr/^\d+$/, + id => qr/^[\w\-_]+$/, }, - 'strong|b|em|i|u|s|strike|del|ins|sup|sub' => { + li => { class => qr/^[\w\s\-_]+$/, + id => qr/^[\w\-_]+$/, }, i => { diff --git a/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl b/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl index 3d56fe9f56..9167240766 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl +++ b/koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetDetail.xsl @@ -14,6 +14,7 @@ + diff --git a/t/Scrubber.t b/t/Scrubber.t index cf2de7d0f1..d99f51be0a 100755 --- a/t/Scrubber.t +++ b/t/Scrubber.t @@ -19,7 +19,7 @@ use Modern::Perl; -use Test::More tests => 7; +use Test::More tests => 8; use Test::NoWarnings; use Test::Exception; use Test::Warn; @@ -156,3 +156,166 @@ subtest 'note scrubber functionality' => sub { unlike( $safe_result, qr/
Safe content
'), + '
Safe content
', + 'script tags removed while safe content preserved' + ); + + is( + $scrubber->scrub('
Content
'), + '
Content
', + 'onclick handler is removed, class is preserved' + ); + + is( + $scrubber->scrub('
Test
'), + '
Test
', + 'valid class with hyphens and underscores allowed' + ); + + is( + $scrubber->scrub('Test'), + 'Test', + 'multiple valid classes allowed' + ); + + is( + $scrubber->scrub('
Test
'), + '
Test
', + 'invalid class with special characters removed' + ); + + is( + $scrubber->scrub('Koha is cool'), + 'Koha is cool', + 'class with dots removed' + ); + + is( + $scrubber->scrub('

Test

'), + '

Test

', + 'valid id with underscores, hyphens, and numbers allowed' + ); + + is( + $scrubber->scrub('

Test

'), + '

Test

', + 'id with spaces removed' + ); + + is( + $scrubber->scrub('
Test
'), + '
Test
', + 'id with special characters removed' + ); + + is( + $scrubber->scrub('Bad actor link'), + 'Bad actor link', + 'javascript href removed' + ); + + is( + $scrubber->scrub('
  1. Roman numeral list
'), + '
  1. Roman numeral list
', + 'ordered list with class and id attributes' + ); + + is( + $scrubber->scrub('
  • Bad class
'), + '
  • Bad class
', + 'invalid list class attribute removed' + ); +}; -- 2.39.5