// Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file // for details. All rights reserved. Use of this source code is governed by a // BSD-style license that can be found in the LICENSE file. library validator_test; import 'dart:async'; import 'dart:html'; import 'dart:svg' as svg; import 'package:unittest/unittest.dart'; import 'package:unittest/html_config.dart'; import 'utils.dart'; var nullSanitizer = new NullTreeSanitizer(); void validateHtml(String html, String reference, NodeValidator validator) { var a = document.body.createFragment(html, validator: validator); var b = document.body.createFragment(reference, treeSanitizer: nullSanitizer); validateNodeTree(a, b); } class RecordingUriValidator implements UriPolicy { final List calls = []; bool allowsUri(String uri) { calls.add('$uri'); return false; } void reset() { calls.clear(); } } void testHtml(String name, NodeValidator validator, String html, [String reference]) { test(name, () { if (reference == null) { reference = html; } validateHtml(html, reference, validator); }); } main() { useHtmlConfiguration(); group('DOM sanitization', () { var validator = new NodeValidatorBuilder.common(); testHtml('allows simple constructs', validator, '

something

'); testHtml('blocks unknown attributes', validator, '

something

', '

something

'); testHtml('blocks custom element', validator, 'something', ''); testHtml('blocks custom is element', validator, '

something

', ''); testHtml('blocks body elements', validator, '', ''); testHtml('allows select elements', validator, ''); testHtml('blocks sequential script elements', validator, '

', '

'); testHtml('blocks namespaced attributes', validator, '

', '

'); testHtml('blocks namespaced common attributes', validator, '

', '

'); testHtml('blocks namespaced common elements', validator, '', ''); testHtml('allows CDATA sections', validator, '![CDATA[ some text ]]>'); test('sanitizes template contents', () { var html = ''; var fragment = document.body.createFragment(html, validator: validator); var template = fragment.nodes.single; var expectedContent = document.body.createFragment( '

' ''); validateNodeTree(template.content, expectedContent); }); }); group('URI sanitization', () { var recorder = new RecordingUriValidator(); var validator = new NodeValidatorBuilder()..allowHtml5(uriPolicy: recorder); checkUriPolicyCalls(String name, String html, String reference, List expectedCalls) { test(name, () { recorder.reset(); validateHtml(html, reference, validator); expect(recorder.calls, expectedCalls); }); } checkUriPolicyCalls('a::href', '', '', ['s']); checkUriPolicyCalls('area::href', '', '', ['s']); checkUriPolicyCalls('blockquote::cite', '

', '

', ['s']); checkUriPolicyCalls('command::icon', '', '', ['s']); checkUriPolicyCalls('img::src', '

', '', ['s']); checkUriPolicyCalls('input::src', '', '', ['s']); checkUriPolicyCalls('ins::cite', '', '', ['s']); checkUriPolicyCalls('q::cite', '', '', ['s']); checkUriPolicyCalls('video::poster', '