first commit
This commit is contained in:
416
plugins/sfXssSafePlugin/test/unit/XssSafeTest.php
Normal file
416
plugins/sfXssSafePlugin/test/unit/XssSafeTest.php
Normal file
@@ -0,0 +1,416 @@
|
||||
<?php
|
||||
|
||||
// initializes testing framework
|
||||
$app = 'frontend';
|
||||
$sf_root = dirname(__FILE__).'/../../../..';
|
||||
require_once($sf_root.'/lib/symfony/vendor/lime/lime.php');
|
||||
include($sf_root.'/test/bootstrap/functional.php');
|
||||
|
||||
// add filters to the default configuration
|
||||
$definitions = array(
|
||||
'Attr' =>
|
||||
array(
|
||||
'AllowedFrameTargets' => array('_blank'),
|
||||
'EnableID' => true
|
||||
),
|
||||
'Filter' =>
|
||||
array(
|
||||
'YouTube' => true,
|
||||
),
|
||||
'URI' =>
|
||||
array(
|
||||
'HostBlacklist' => array ('www.symfony-project.org')
|
||||
),
|
||||
'HTML' =>
|
||||
array(
|
||||
'DefinitionID' => 'allow flash movies',
|
||||
'DefinitionRev' => 1
|
||||
),
|
||||
'AutoFormat' =>
|
||||
array(
|
||||
'Element' =>
|
||||
array(
|
||||
'param' => array(
|
||||
'type' => false,
|
||||
'contents' => 'Empty',
|
||||
'attr_includes' => false,
|
||||
'attr' => array(
|
||||
'name' => 'Text',
|
||||
'value' => 'Text'
|
||||
)
|
||||
),
|
||||
'object' => array(
|
||||
'type' => 'Inline',
|
||||
'contents' => 'Optional: param | Flow | #PCDATA',
|
||||
'attr_includes' => false,
|
||||
'attr' => array (
|
||||
'type*' => 'Enum#application/x-shockwave-flash',
|
||||
'width*' => 'Pixels',
|
||||
'height*' => 'Pixels',
|
||||
'data' => 'Text',
|
||||
'bgcolor*' => 'Text',
|
||||
'quality*' => 'Text'
|
||||
)
|
||||
),
|
||||
'embed' => array(
|
||||
'type' => 'Block',
|
||||
'contents' => 'Empty',
|
||||
'attr_includes' => false,
|
||||
'attr' => array(
|
||||
'type*' => 'Enum#application/x-shockwave-flash',
|
||||
'width*' => 'Pixels',
|
||||
'height*' => 'Pixels',
|
||||
'src*' => 'URI',
|
||||
'flashvars' => 'Text',
|
||||
'allowscriptaccess' => 'Enum#never',
|
||||
'enablejsurls' => 'Enum#false',
|
||||
'enablehref' => 'Enum#false',
|
||||
'bgcolor' => 'Text',
|
||||
'align' => 'Text',
|
||||
'quality' => 'Text',
|
||||
'wmode' => 'Text',
|
||||
'pluginspage' => 'URI',
|
||||
'saveembedtags' => 'Text',
|
||||
'salign' => 'Text',
|
||||
'scale' => 'Text',
|
||||
'name' => 'Text'
|
||||
)
|
||||
)
|
||||
)
|
||||
)
|
||||
);
|
||||
|
||||
// force configuration
|
||||
sfConfig::set('app_sfXssSafePlugin_definition', $definitions);
|
||||
|
||||
$xsssafe_tests = array(
|
||||
'XSS Quick Test' => array(
|
||||
'input' => '\'\';!--"<XSS>=&{()}',
|
||||
'output' => '\'\';!--"=&{()}'
|
||||
),
|
||||
'SCRIPT w/Alert()' => array(
|
||||
'input' => '<SCRIPT>alert(\'XSS\')</SCRIPT>',
|
||||
'output' => ''
|
||||
),
|
||||
'SCRIPT w/Source File' => array(
|
||||
'input' => '<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>',
|
||||
'output' => ''
|
||||
),
|
||||
'SCRIPT w/Char Code' => array(
|
||||
'input' => '<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>',
|
||||
'output' => ''
|
||||
),
|
||||
'BASE' => array(
|
||||
'input' => '<BASE HREF="javascript:alert(\'XSS\');//">',
|
||||
'output' => ''
|
||||
),
|
||||
'BGSOUND' => array(
|
||||
'input' => '<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>',
|
||||
'output' => ''
|
||||
),
|
||||
'BODY background-image' => array(
|
||||
'input' => '<BODY BACKGROUND="javascript:alert(\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'BODY ONLOAD' => array(
|
||||
'input' => '<BODY ONLOAD=alert(\'XSS\')>',
|
||||
'output' => ''
|
||||
),
|
||||
'DIV background-image' => array(
|
||||
'input' => '<DIV STYLE="background-image: url(javascript:alert(\'XSS\'))">',
|
||||
'output' => '<div></div>'
|
||||
),
|
||||
'DIV expression' => array(
|
||||
'input' => '<DIV STYLE="width: expression(alert(\'XSS\'));">',
|
||||
'output' => '<div></div>'
|
||||
),
|
||||
'FRAME' => array(
|
||||
'input' => '<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>',
|
||||
'output' => ''
|
||||
),
|
||||
'IFRAME' => array(
|
||||
'input' => '<IFRAME SRC="javascript:alert(\'XSS\');"></IFRAME>',
|
||||
'output' => ''
|
||||
),
|
||||
'IMG w/JavaScript Directive' => array(
|
||||
'input' => '<IMG SRC="javascript:alert(\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'IMG No Quotes/Semicolon' => array(
|
||||
'input' => '<IMG SRC=javascript:alert(\'XSS\')>',
|
||||
'output' => ''
|
||||
),
|
||||
'IMG Dynsrc' => array(
|
||||
'input' => '<IMG DYNSRC="javascript:alert(\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'IMG Lowsrc' => array(
|
||||
'input' => '<IMG LOWSRC="javascript:alert(\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'IMG Embedded commands 1' => array(
|
||||
'input' => '<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">',
|
||||
'output' => '<img src="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode" alt="somecommand.php?somevariables=maliciouscode" />'
|
||||
),
|
||||
'IMG STYLE w/expression' => array(
|
||||
'input' => 'exp/*<XSS STYLE=\'no\xss:noxss("*//*"); xss:ex/*XSS*//*/* /pression(alert("XSS"))\'>',
|
||||
'output' => 'exp/*'
|
||||
),
|
||||
'List-style-image' => array(
|
||||
'input' => '<STYLE>li {list-style-image: url("javascript:alert(\'XSS\')");}</STYLE><UL><LI>XSS',
|
||||
'output' => '<ul><li>XSS</li></ul>'
|
||||
),
|
||||
'IMG w/VBscript' => array(
|
||||
'input' => '<IMG SRC=\'vbscript:msgbox("XSS")\'>',
|
||||
'output' => ''
|
||||
),
|
||||
'LAYER' => array(
|
||||
'input' => '<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>',
|
||||
'output' => ''
|
||||
),
|
||||
'Livescript' => array(
|
||||
'input' => ' <IMG SRC="livescript:[code]">',
|
||||
'output' => ''
|
||||
),
|
||||
'META' => array(
|
||||
'input' => '<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'META w/data:URL' => array(
|
||||
'input' => '<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">',
|
||||
'output' => ''
|
||||
),
|
||||
'META w/additional URL parameter' => array(
|
||||
'input' => '<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'OBJECT' => array(
|
||||
'input' => '<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>',
|
||||
'output' => ''
|
||||
),
|
||||
'OBJECT w/Embedded XSS' => array(
|
||||
'input' => '<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(\'XSS\')></OBJECT>',
|
||||
'output' => ''
|
||||
),
|
||||
'Embed Flash' => array(
|
||||
'input' => '<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>',
|
||||
'output' => ''
|
||||
),
|
||||
'STYLE' => array(
|
||||
'input' => '<STYLE TYPE="text/javascript">alert(\'XSS\');</STYLE>',
|
||||
'output' => ''
|
||||
),
|
||||
'STYLE w/Comment' => array(
|
||||
'input' => '<IMG STYLE="xss:expr/*XSS*/ession(alert(\'XSS\'))">',
|
||||
'output' => ''
|
||||
),
|
||||
'STYLE w/Anonymous HTML' => array(
|
||||
'input' => '<XSS STYLE="xss:expression(alert(\'XSS\'))">',
|
||||
'output' => ''
|
||||
),
|
||||
'STYLE w/background-image' => array(
|
||||
'input' => '<STYLE>.XSS{background-image:url("javascript:alert(\'XSS\')");}</STYLE><A CLASS=XSS></A>',
|
||||
'output' => '<a class="XSS"></a>'
|
||||
),
|
||||
'STYLE w/background' => array(
|
||||
'input' => '<STYLE type="text/css">BODY{background:url("javascript:alert(\'XSS\')")}</STYLE>',
|
||||
'output' => ''
|
||||
),
|
||||
'Stylesheet' => array(
|
||||
'input' => '<LINK REL="stylesheet" HREF="javascript:alert(\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'Remote Stylesheet' => array(
|
||||
'input' => '<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">',
|
||||
'output' => ''
|
||||
),
|
||||
'TABLE' => array(
|
||||
'input' => '<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')"></TD></TABLE>',
|
||||
'output' => ''
|
||||
),
|
||||
'PHP' => array(
|
||||
'input' => '<? echo(\'<SCR)\'; echo(\'IPT>alert("XSS")</SCRIPT>\'); ?>',
|
||||
'output' => '<? echo(\'alert("XSS")\'); ?>',
|
||||
),
|
||||
'JavaScript Link Location' => array(
|
||||
'input' => '<A HREF="javascript:document.location=\'http://www.google.com/\'">XSS</A>',
|
||||
'output' => '<a>XSS</a>'
|
||||
),
|
||||
'Case Insensitive' => array(
|
||||
'input' => '<IMG
|
||||
SRC=JaVaScRiPt:alert(\'XSS\')>',
|
||||
'output' => ''
|
||||
),
|
||||
'HTML Entities' => array(
|
||||
'input' => '<IMG
|
||||
SRC=javascript:alert("X
|
||||
SS")>',
|
||||
'output' => ''
|
||||
),
|
||||
'Grave Accents' => array(
|
||||
'input' => '<IMG
|
||||
SRC=`javascript:alert("RSnak
|
||||
e says, \'XSS\'")`>',
|
||||
'output' => ''
|
||||
),
|
||||
'Image w/CharCode' => array(
|
||||
'input' => '<IMG
|
||||
SRC=javascript:alert(String.
|
||||
fromCharCode(88,83,83))>',
|
||||
'output' => ''
|
||||
),
|
||||
'Escaping JavaScript escapes' => array(
|
||||
'input' => <<<END
|
||||
\";alert('XSS');//
|
||||
END
|
||||
,
|
||||
'output' => <<<END
|
||||
\";alert('XSS');//
|
||||
END
|
||||
),
|
||||
'End title tag' => array(
|
||||
'input' => '</TITLE><SCRIPT>alert("XSS")
|
||||
;</SCRIPT>',
|
||||
'output' => ''
|
||||
),
|
||||
'STYLE w/broken up JavaScript' => array(
|
||||
'input' => <<<END
|
||||
<STYLE>@im\port'\ja\vasc\rip
|
||||
t:alert("XSS")';</STYLE>
|
||||
END
|
||||
,
|
||||
'output' => ''
|
||||
),
|
||||
'Embedded Tab' => array(
|
||||
'input' => '<IMG
|
||||
SRC="jav\tascript:alert(\'XSS\'
|
||||
);">',
|
||||
'output' => ''
|
||||
),
|
||||
'Embedded Encoded Tab' => array(
|
||||
'input' => '<IMG
|
||||
SRC="jav	ascript:alert(
|
||||
\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'Embedded Newline' => array(
|
||||
'input' => '<IMG
|
||||
SRC="jav
ascript:alert(
|
||||
\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'Embedded Carriage Return' => array(
|
||||
'input' => '<IMG
|
||||
SRC="jav
ascript:alert(
|
||||
\'XSS\');">',
|
||||
'output' => ''
|
||||
),
|
||||
'Multiline w/Carriage Returns' => array(
|
||||
'input' => <<<END
|
||||
<IMG
|
||||
SRC
|
||||
=
|
||||
"
|
||||
j
|
||||
a
|
||||
v
|
||||
a
|
||||
s
|
||||
c
|
||||
r
|
||||
i
|
||||
p
|
||||
t
|
||||
:
|
||||
a
|
||||
l
|
||||
e
|
||||
r
|
||||
t
|
||||
(
|
||||
'
|
||||
X
|
||||
S
|
||||
S
|
||||
'
|
||||
)
|
||||
"
|
||||
>
|
||||
END
|
||||
,
|
||||
'output' => ''
|
||||
),
|
||||
'Firefox Lookups' => array(
|
||||
'input' => '<A HREF="http://google:ha.ckers.org">XSS</A>',
|
||||
'output' => '<a href="http://google">XSS</a>'
|
||||
),
|
||||
'Content Replace' => array(
|
||||
'input' => '<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>',
|
||||
'output' => '<a href="http://www.gohttp//www.google.com/ogle.com/">XSS</a>'
|
||||
),
|
||||
'Mixed Encoding' => array(
|
||||
'input' => <<<END
|
||||
<A HREF="htt\tp://6	6.000146.0x7.147/">XSS</A>
|
||||
END
|
||||
,
|
||||
'output' => '<a>XSS</a>'
|
||||
)
|
||||
);
|
||||
|
||||
$miscellaneous_tests = array(
|
||||
'YouTube Filter' => array(
|
||||
'input' => '<object width="425" height="355"><param name="movie" value="http://www.youtube.com/v/HLHKgepRZ8M&hl=fr"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/HLHKgepRZ8M&hl=fr" type="application/x-shockwave-flash" wmode="transparent" width="425" height="355"></embed></object>',
|
||||
'output' => '<object width="425" height="350" data="http://www.youtube.com/v/HLHKgepRZ8M"><param name="movie" value="http://www.youtube.com/v/HLHKgepRZ8M"></param><param name="wmode" value="transparent"></param><!--[if IE]><embed src="http://www.youtube.com/v/HLHKgepRZ8M"type="application/x-shockwave-flash"wmode="transparent" width="425" height="350" /><![endif]--></object>',
|
||||
'filter' => true
|
||||
),
|
||||
'Allowed Frame Targets Filter' => array(
|
||||
'input' => '<a href="" target="_blank"></a>',
|
||||
'output' => '<a href="" target="_blank"></a>',
|
||||
'filter' => true
|
||||
),
|
||||
'Enable ID' => array(
|
||||
'input' => '<div id="test"></div>',
|
||||
'output' => '<div id="test"></div>',
|
||||
'filter' => true
|
||||
),
|
||||
'Host Blacklist' => array(
|
||||
'input' => '<a href="http://www.symfony-project.org/">Symfony Project</a>',
|
||||
'output' => '<a>Symfony Project</a>',
|
||||
'filter' => true
|
||||
),
|
||||
'Enable Object' => array(
|
||||
'input' => '<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0" id="video_small" align="middle" height="370" width="417">
|
||||
<param name="allowScriptAccess" value="sameDomain">
|
||||
<param name="allowFullScreen" value="false">
|
||||
<param name="FlashVars" value="video=http://www.toppeo.com/flv/demospectacle4473EE7B_8003221.flv">
|
||||
<param name="movie" value="/player/player.swf"><param name="quality" value="high">
|
||||
<param name="bgcolor" value="#000000">
|
||||
<embed src="/player/player.swf" flashvars="video=http://www.toppeo.com/flv/demospectacle4473EE7B_8003221.flv" quality="high" bgcolor="#000000" name="video_small" allowscriptaccess="sameDomain" allowfullscreen="false" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" align="middle" height="370" width="417">
|
||||
</object>',
|
||||
'output' => '<embed src="/player/player.swf" flashvars="video=http://www.toppeo.com/flv/demospectacle4473EE7B_8003221.flv" quality="high" bgcolor="#000000" name="video_small" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" align="middle" height="370" width="417" enablejsurls="false" enablehref="false" allowfullscreen="true" />',
|
||||
'filter' => true
|
||||
)
|
||||
);
|
||||
|
||||
$t = new lime_test(count($xsssafe_tests)+count($miscellaneous_tests)+2, new lime_output_color());
|
||||
|
||||
// XssSafe Helper
|
||||
$t->diag('XssSafe Helper');
|
||||
$t->include_ok(sfConfig::get('sf_plugins_dir').'/sfXssSafePlugin/lib/helper/XssSafeHelper.php', 'XssSafe Helper include');
|
||||
$t->include_ok(sfConfig::get('sf_plugins_dir').'/sfXssSafePlugin/lib/vendor/htmlpurifier/HTMLPurifier.auto.php', 'HTML Purifier include');
|
||||
|
||||
// XSS Attacks Smoketest
|
||||
$t->diag('XSS Attacks Smoketest');
|
||||
foreach ($xsssafe_tests as $name => $test)
|
||||
{
|
||||
$t->is(esc_xsssafe($test['input']), $test['output'], $name . sprintf('%s', isset($test['filter']) ? ' is properly filtered' : ' is properly escaped'));
|
||||
}
|
||||
|
||||
// HTML Purifier Config
|
||||
$t->diag('HTML Purifier Config');
|
||||
foreach ($miscellaneous_tests as $name => $test)
|
||||
{
|
||||
$t->is(trim(esc_xsssafe($test['input'])), $test['output'], $name . sprintf('%s', isset($test['filter']) ? ' is properly filtered' : ' is properly escaped'));
|
||||
}
|
||||
|
||||
?>
|
||||
Reference in New Issue
Block a user