From 14db231aa55cc19f32cf1ef253c313ade15b98e4 Mon Sep 17 00:00:00 2001 From: Lucas Gass Date: Thu, 23 Oct 2025 13:48:05 +0000 Subject: [PATCH] Bug 40659: Unit tests for new Scrubber profile --- t/Scrubber.t | 140 ++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 139 insertions(+), 1 deletion(-) diff --git a/t/Scrubber.t b/t/Scrubber.t index b9fe81040fd..33765e55627 100755 --- a/t/Scrubber.t +++ b/t/Scrubber.t @@ -158,7 +158,7 @@ subtest 'note scrubber functionality' => sub { }; subtest 'record_display profile tests' => sub { - plan tests => 26; + plan tests => 27; my $scrubber = C4::Scrubber->new('record_display'); @@ -318,4 +318,142 @@ subtest 'record_display profile tests' => sub { '', 'invalid list class attribute removed' ); + + subtest 'opac profile tests' => sub { + plan tests => 20; + + my $scrubber = C4::Scrubber->new('opac'); + + # Test basic allowed elements + is( + $scrubber->scrub('
hello world!
'), + '
hello world!
', + 'div with id and class allowed' + ); + + is( + $scrubber->scrub('

Luke G

'), + '

Luke G

', + 'p with id and class allowed' + ); + + is( + $scrubber->scrub('Important'), + 'Important', + 'span with class allowed' + ); + + is( + $scrubber->scrub('

Card Title

supercalifragilisticexpialidocious

'), + '

Card Title

supercalifragilisticexpialidocious

', + 'heading elements allowed' + ); + + # Test SVG with barcode attributes + is( + $scrubber->scrub(''), + '', + 'svg with barcode attributes allowed' + ); + + is( + $scrubber->scrub( + '
' + ), + '
', + 'div with svg barcode inside preserved' + ); + + # Test list elements + is( + $scrubber->scrub(''), + '', + 'unordered lists allowed' + ); + + is( + $scrubber->scrub('
  1. First
  2. Second
'), + '
  1. First
  2. Second
', + 'ordered lists allowed' + ); + + is( + $scrubber->scrub('
Term
Definition
'), + '
Term
Definition
', + 'definition lists allowed' + ); + + # Test text formatting + is( + $scrubber->scrub('Bold Italic Underline'), + 'Bold Italic Underline', + 'text formatting elements allowed' + ); + + is( + $scrubber->scrub('Bold Italic'), + 'Bold Italic', + 'alternative text formatting allowed' + ); + + is( + $scrubber->scrub('

Line 1
Line 2

'), + '

Line 1
Line 2

', + 'br tags allowed' + ); + + is( + $scrubber->scrub('
'), + '
', + 'hr tags allowed' + ); + + # Test security - malicious content removal + is( + $scrubber->scrub('
Safe content
'), + '
Safe content
', + 'script tags removed while safe content preserved' + ); + + is( + $scrubber->scrub('
Content
'), + '
Content
', + 'onclick handler removed' + ); + + is( + $scrubber->scrub( + ''), + '', + 'svg onload handler removed while valid attributes preserved' + ); + + is( + $scrubber->scrub('
Content
'), + '
Content
', + 'inline styles removed' + ); + + # Test invalid attribute removal + is( + $scrubber->scrub('
Test
'), + '
Test
', + 'invalid id with spaces removed' + ); + + is( + $scrubber->scrub('Content'), + 'Content', + 'invalid svg attributes removed' + ); + + # Test comprehensive virtual card example + my $card_html = + '

Library: Centerville

Card number: 42

'; + is( + $scrubber->scrub($card_html), + $card_html, + 'complete virtual card HTML preserved' + ); + }; }; -- 2.39.5