test previously untested global policy merging code in PolicyFactory

Author: mikesamuel

src/test/java/org/owasp/html/PolicyFactoryTest.java

@@ -0,0 +1,223 @@
+// Copyright (c) 2019, Mike Samuel
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+//
+// Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// Redistributions in binary form must reproduce the above copyright
+// notice, this list of conditions and the following disclaimer in the
+// documentation and/or other materials provided with the distribution.
+// Neither the name of the OWASP nor the names of its contributors may
+// be used to endorse or promote products derived from this software
+// without specific prior written permission.
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+// INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+// BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+// LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+// ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+// POSSIBILITY OF SUCH DAMAGE.
+
+package org.owasp.html;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import org.junit.Test;
+
+import com.google.common.base.Joiner;
+
+import junit.framework.TestCase;
+
+@SuppressWarnings({ "javadoc" })
+public final class PolicyFactoryTest extends TestCase {
+
+ @Test
+ public static void testAnd() {
+ // Filters srcset to only contain URLs with the substring "foo"
+ PolicyFactory f = new HtmlPolicyBuilder()
+ .allowElements("img")
+ .allowAttributes("srcset")
+ .matching(new SubstringFilter("foo"))
+ .globally()
+ .allowStandardUrlProtocols()
+ .toFactory();
+ // Filters srcset to only contain URLs with the substring "bar"
+ PolicyFactory g = new HtmlPolicyBuilder()
+ .allowElements("img")
+ .allowAttributes("srcset")
+ .matching(new SubstringFilter("bar"))
+ .globally()
+ .allowStandardUrlProtocols()
+ .toFactory();
+
+ // The javascript URL will be allowed if the extra policies are not
+ // preserved.
+ String html = "<img"
+ + " srcset=\"/foo.png , /bar.png , javascript:alert('foobar') , /foobar.png\""
+ // title is not whitelisted.
+ + " title=Hi>!";
+
+ PolicyFactory[] factories = {
+ f,
+ g,
+ // Test that .and() intersects regardless of order.
+ f.and(g),
+ g.and(f),
+ };
+ String[] expectedOutputs = {
+ // f
+ "<img srcset=\"/foo.png , /foobar.png\" />",
+
+ // g
+ "<img srcset=\"/bar.png , /foobar.png\" />",
+
+ // f and g
+ "<img srcset=\"/foobar.png\" />",
+
+ // g and f
+ "<img srcset=\"/foobar.png\" />",
+ };
+ String[] expectedLogs = {
+ // f
+ ""
+ + "discardedAttributes img, [title]\n"
+ + "Handled IOException BANG\n",
+
+ // g
+ ""
+ + "discardedAttributes img, [title]\n"
+ + "Handled IOException BANG\n",
+
+ // f and g
+ ""
+ + "discardedAttributes img, [title]\n"
+ + "Handled IOException BANG\n",
+
+ // g and f
+ ""
+ + "discardedAttributes img, [title]\n"
+ + "Handled IOException BANG\n",
+ };
+
+ for (int i = 0; i < factories.length; ++i) {
+ PolicyFactory factory = factories[i];
+ String expectedOutput = expectedOutputs[i];
+ String expectedLog = expectedLogs[i];
+
+ // A dummy value that lets us check that context is properly threaded
+ // through joined policies.
+ final Object context = new Object();
+ // Collect events from callbacks.
+ final StringBuilder log = new StringBuilder();
+ // Collects output HTML.
+ final StringBuilder out = new StringBuilder();
+
+ // A noisy listener that logs.
+ HtmlChangeListener<Object> listener = new HtmlChangeListener<Object>() {
+
+ public void discardedTag(Object ctx, String elementName) {
+ assertEquals(context, ctx);
+ log.append("discardedTag " + elementName + "\n");
+ }
+
+ public void discardedAttributes(
+ Object ctx, String tagName, String... attributeNames) {
+ assertEquals(context, ctx);
+ log.append(
+ "discardedAttributes " + tagName
+ + ", " + Arrays.asList(attributeNames)
+ + "\n");
+ }
+
+ };
+
+ Handler<IOException> ioHandler = new Handler<IOException>() {
+
+ public void handle(IOException x) {
+ log.append("Handled IOException " + x.getMessage() + "\n");
+ }
+
+ };
+
+ // Should not be called.
+ Handler<String> badHtmlHandler = new Handler<String>() {
+
+ public void handle(String x) {
+ throw new AssertionError(x);
+ }
+
+ };
+
+ // Wraps out to throw when a '!' is written to test the ioHandler.
+ // There is a '!' at the end of the output.
+ Appendable throwingOut = new Appendable() {
+
+ public Appendable append(CharSequence csq) throws IOException {
+ return append(csq, 0, csq.length());
+ }
+
+ public Appendable append(CharSequence csq, int start, int end) throws IOException {
+ for (int j = start; j < end; ++j) {
+ if (csq.charAt(j) == '!') {
+ throw new IOException("BANG");
+ }
+ }
+ out.append(csq, start, end);
+ return this;
+ }
+
+ public Appendable append(char c) throws IOException {
+ if (c == '!') {
+ throw new IOException("BANG");
+ }
+ out.append(c);
+ return this;
+ }
+
+ };
+
+ HtmlStreamEventReceiver receiver = new HtmlStreamRenderer(
+ throwingOut, ioHandler, badHtmlHandler);
+ HtmlSanitizer.Policy policy = factory.apply(
+ receiver, listener, context);
+ HtmlSanitizer.sanitize(html, policy);
+
+ assertEquals(
+ "i:" + i,
+
+ "Out:\n" + expectedOutput + "\n\nLog:\n" + expectedLog,
+ "Out:\n" + out + "\n\nLog:\n" + log);
+ }
+ }
+
+ static final class SubstringFilter implements AttributePolicy {
+ final String substr;
+
+ SubstringFilter(String substr) {
+ this.substr = substr;
+ }
+
+ public String apply(
+ String elementName, String attributeName, String value) {
+ List<String> outParts = new ArrayList<String>();
+ for (String part : value.split(",")) {
+ part = part.trim();
+ if (part.contains(substr)) {
+ outParts.add(part);
+ }
+ }
+ return Joiner.on(" , ").join(outParts);
+ }
+ }
+}