Chris@0: <?php
Chris@0: 
Chris@0: namespace Drupal\Tests\Component\Utility;
Chris@0: 
Chris@0: use Drupal\Component\Utility\Html;
Chris@0: use Drupal\Component\Utility\UrlHelper;
Chris@0: use Drupal\Component\Utility\Xss;
Chris@0: use PHPUnit\Framework\TestCase;
Chris@0: 
Chris@0: /**
Chris@0:  * XSS Filtering tests.
Chris@0:  *
Chris@0:  * @group Utility
Chris@0:  *
Chris@0:  * @coversDefaultClass \Drupal\Component\Utility\Xss
Chris@0:  *
Chris@0:  * Script injection vectors mostly adopted from http://ha.ckers.org/xss.html.
Chris@0:  *
Chris@0:  * Relevant CVEs:
Chris@0:  * - CVE-2002-1806, ~CVE-2005-0682, ~CVE-2005-2106, CVE-2005-3973,
Chris@0:  *   CVE-2006-1226 (= rev. 1.112?), CVE-2008-0273, CVE-2008-3740.
Chris@0:  */
Chris@0: class XssTest extends TestCase {
Chris@0: 
Chris@0:   /**
Chris@0:    * {@inheritdoc}
Chris@0:    */
Chris@0:   protected function setUp() {
Chris@0:     parent::setUp();
Chris@0: 
Chris@0:     $allowed_protocols = [
Chris@0:       'http',
Chris@0:       'https',
Chris@0:       'ftp',
Chris@0:       'news',
Chris@0:       'nntp',
Chris@0:       'telnet',
Chris@0:       'mailto',
Chris@0:       'irc',
Chris@0:       'ssh',
Chris@0:       'sftp',
Chris@0:       'webcal',
Chris@0:       'rtsp',
Chris@0:     ];
Chris@0:     UrlHelper::setAllowedProtocols($allowed_protocols);
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Tests limiting allowed tags and XSS prevention.
Chris@0:    *
Chris@0:    * XSS tests assume that script is disallowed by default and src is allowed
Chris@0:    * by default, but on* and style attributes are disallowed.
Chris@0:    *
Chris@0:    * @param string $value
Chris@0:    *   The value to filter.
Chris@0:    * @param string $expected
Chris@0:    *   The expected result.
Chris@0:    * @param string $message
Chris@0:    *   The assertion message to display upon failure.
Chris@0:    * @param array $allowed_tags
Chris@0:    *   (optional) The allowed HTML tags to be passed to \Drupal\Component\Utility\Xss::filter().
Chris@0:    *
Chris@0:    * @dataProvider providerTestFilterXssNormalized
Chris@0:    */
Chris@0:   public function testFilterXssNormalized($value, $expected, $message, array $allowed_tags = NULL) {
Chris@0:     if ($allowed_tags === NULL) {
Chris@0:       $value = Xss::filter($value);
Chris@0:     }
Chris@0:     else {
Chris@0:       $value = Xss::filter($value, $allowed_tags);
Chris@0:     }
Chris@0:     $this->assertNormalized($value, $expected, $message);
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Data provider for testFilterXssNormalized().
Chris@0:    *
Chris@0:    * @see testFilterXssNormalized()
Chris@0:    *
Chris@0:    * @return array
Chris@0:    *   An array of arrays containing strings:
Chris@0:    *     - The value to filter.
Chris@0:    *     - The value to expect after filtering.
Chris@0:    *     - The assertion message.
Chris@0:    *     - (optional) The allowed HTML HTML tags array that should be passed to
Chris@0:    *       \Drupal\Component\Utility\Xss::filter().
Chris@0:    */
Chris@0:   public function providerTestFilterXssNormalized() {
Chris@0:     return [
Chris@0:       [
Chris@0:         "Who&#039;s Online",
Chris@0:         "who's online",
Chris@0:         'HTML filter -- html entity number',
Chris@0:       ],
Chris@0:       [
Chris@0:         "Who&amp;#039;s Online",
Chris@0:         "who&#039;s online",
Chris@0:         'HTML filter -- encoded html entity number',
Chris@0:       ],
Chris@0:       [
Chris@0:         "Who&amp;amp;#039; Online",
Chris@0:         "who&amp;#039; online",
Chris@0:         'HTML filter -- double encoded html entity number',
Chris@0:       ],
Chris@0:       // Custom elements with dashes in the tag name.
Chris@0:       [
Chris@0:         "<test-element></test-element>",
Chris@0:         "<test-element></test-element>",
Chris@0:         'Custom element with dashes in tag name.',
Chris@0:         ['test-element'],
Chris@0:       ],
Chris@0:     ];
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Tests limiting to allowed tags and XSS prevention.
Chris@0:    *
Chris@0:    * XSS tests assume that script is disallowed by default and src is allowed
Chris@0:    * by default, but on* and style attributes are disallowed.
Chris@0:    *
Chris@0:    * @param string $value
Chris@0:    *   The value to filter.
Chris@0:    * @param string $expected
Chris@0:    *   The string that is expected to be missing.
Chris@0:    * @param string $message
Chris@0:    *   The assertion message to display upon failure.
Chris@0:    * @param array $allowed_tags
Chris@0:    *   (optional) The allowed HTML tags to be passed to \Drupal\Component\Utility\Xss::filter().
Chris@0:    *
Chris@0:    * @dataProvider providerTestFilterXssNotNormalized
Chris@0:    */
Chris@0:   public function testFilterXssNotNormalized($value, $expected, $message, array $allowed_tags = NULL) {
Chris@0:     if ($allowed_tags === NULL) {
Chris@0:       $value = Xss::filter($value);
Chris@0:     }
Chris@0:     else {
Chris@0:       $value = Xss::filter($value, $allowed_tags);
Chris@0:     }
Chris@0:     $this->assertNotNormalized($value, $expected, $message);
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Data provider for testFilterXssNotNormalized().
Chris@0:    *
Chris@0:    * @see testFilterXssNotNormalized()
Chris@0:    *
Chris@0:    * @return array
Chris@0:    *   An array of arrays containing the following elements:
Chris@0:    *     - The value to filter.
Chris@0:    *     - The value to expect that's missing after filtering.
Chris@0:    *     - The assertion message.
Chris@0:    *     - (optional) The allowed HTML HTML tags array that should be passed to
Chris@0:    *       \Drupal\Component\Utility\Xss::filter().
Chris@0:    */
Chris@0:   public function providerTestFilterXssNotNormalized() {
Chris@0:     $cases = [
Chris@0:       // Tag stripping, different ways to work around removal of HTML tags.
Chris@0:       [
Chris@0:         '<script>alert(0)</script>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping -- simple script without special characters.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<script src="http://www.example.com" />',
Chris@0:         'script',
Chris@0:         'HTML tag stripping -- empty script with source.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<ScRipt sRc=http://www.example.com/>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- varying case.',
Chris@0:       ],
Chris@0:       [
Chris@0:         "<script\nsrc\n=\nhttp://www.example.com/\n>",
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- multiline tag.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<script/a src=http://www.example.com/a.js></script>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- non whitespace character after tag name.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<script/src=http://www.example.com/a.js></script>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- no space between tag and attribute.',
Chris@0:       ],
Chris@0:       // Null between < and tag name works at least with IE6.
Chris@0:       [
Chris@0:         "<\0scr\0ipt>alert(0)</script>",
Chris@0:         'ipt',
Chris@0:         'HTML tag stripping evasion -- breaking HTML with nulls.',
Chris@0:       ],
Chris@0:       [
Chris@0:         "<scrscriptipt src=http://www.example.com/a.js>",
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- filter just removing "script".',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<<script>alert(0);//<</script>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- double opening brackets.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<script src=http://www.example.com/a.js?<b>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- no closing tag.',
Chris@0:       ],
Chris@0:       // DRUPAL-SA-2008-047: This doesn't seem exploitable, but the filter should
Chris@0:       // work consistently.
Chris@0:       [
Chris@0:         '<script>>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- double closing tag.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<script src=//www.example.com/.a>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- no scheme or ending slash.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<script src=http://www.example.com/.a',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- no closing bracket.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<script src=http://www.example.com/ <',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- opening instead of closing bracket.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<nosuchtag attribute="newScriptInjectionVector">',
Chris@0:         'nosuchtag',
Chris@0:         'HTML tag stripping evasion -- unknown tag.',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<t:set attributeName="innerHTML" to="&lt;script defer&gt;alert(0)&lt;/script&gt;">',
Chris@0:         't:set',
Chris@0:         'HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).',
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img """><script>alert(0)</script>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- a malformed image tag.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<blockquote><script>alert(0)</script></blockquote>',
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- script in a blockqoute.',
Chris@0:         ['blockquote'],
Chris@0:       ],
Chris@0:       [
Chris@0:         "<!--[if true]><script>alert(0)</script><![endif]-->",
Chris@0:         'script',
Chris@0:         'HTML tag stripping evasion -- script within a comment.',
Chris@0:       ],
Chris@0:       // Dangerous attributes removal.
Chris@0:       [
Chris@0:         '<p onmouseover="http://www.example.com/">',
Chris@0:         'onmouseover',
Chris@0:         'HTML filter attributes removal -- events, no evasion.',
Chris@0:         ['p'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<li style="list-style-image: url(javascript:alert(0))">',
Chris@0:         'style',
Chris@0:         'HTML filter attributes removal -- style, no evasion.',
Chris@0:         ['li'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img onerror   =alert(0)>',
Chris@0:         'onerror',
Chris@0:         'HTML filter attributes removal evasion -- spaces before equals sign.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img onabort!#$%&()*~+-_.,:;?@[/|\]^`=alert(0)>',
Chris@0:         'onabort',
Chris@0:         'HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img oNmediAError=alert(0)>',
Chris@0:         'onmediaerror',
Chris@0:         'HTML filter attributes removal evasion -- varying case.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       // Works at least with IE6.
Chris@0:       [
Chris@0:         "<img o\0nfocus\0=alert(0)>",
Chris@0:         'focus',
Chris@0:         'HTML filter attributes removal evasion -- breaking with nulls.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       // Only whitelisted scheme names allowed in attributes.
Chris@0:       [
Chris@0:         '<img src="javascript:alert(0)">',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing -- no evasion.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src=javascript:alert(0)>',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- no quotes.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       // A bit like CVE-2006-0070.
Chris@0:       [
Chris@0:         '<img src="javascript:confirm(0)">',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- no alert ;)',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src=`javascript:alert(0)`>',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- grave accents.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img dynsrc="javascript:alert(0)">',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing -- rare attribute.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<table background="javascript:alert(0)">',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing -- another tag.',
Chris@0:         ['table'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<base href="javascript:alert(0);//">',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing -- one more attribute and tag.',
Chris@0:         ['base'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src="jaVaSCriPt:alert(0)">',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- varying case.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#48;&#41;>',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- UTF-8 decimal encoding.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src=&#00000106&#0000097&#00000118&#0000097&#00000115&#0000099&#00000114&#00000105&#00000112&#00000116&#0000058&#0000097&#00000108&#00000101&#00000114&#00000116&#0000040&#0000048&#0000041>',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- long UTF-8 encoding.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x30&#x29>',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- UTF-8 hex encoding.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         "<img src=\"jav\tascript:alert(0)\">",
Chris@0:         'script',
Chris@0:         'HTML scheme clearing evasion -- an embedded tab.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src="jav&#x09;ascript:alert(0)">',
Chris@0:         'script',
Chris@0:         'HTML scheme clearing evasion -- an encoded, embedded tab.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src="jav&#x000000A;ascript:alert(0)">',
Chris@0:         'script',
Chris@0:         'HTML scheme clearing evasion -- an encoded, embedded newline.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       // With &#xD; this test would fail, but the entity gets turned into
Chris@0:       // &amp;#xD;, so it's OK.
Chris@0:       [
Chris@0:         '<img src="jav&#x0D;ascript:alert(0)">',
Chris@0:         'script',
Chris@0:         'HTML scheme clearing evasion -- an encoded, embedded carriage return.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         "<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">",
Chris@0:         'cript',
Chris@0:         'HTML scheme clearing evasion -- broken into many lines.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         "<img src=\"jav\0a\0\0cript:alert(0)\">",
Chris@0:         'cript',
Chris@0:         'HTML scheme clearing evasion -- embedded nulls.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src="vbscript:msgbox(0)">',
Chris@0:         'vbscript',
Chris@0:         'HTML scheme clearing evasion -- another scheme.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src="nosuchscheme:notice(0)">',
Chris@0:         'nosuchscheme',
Chris@0:         'HTML scheme clearing evasion -- unknown scheme.',
Chris@0:         ['img'],
Chris@0:       ],
Chris@0:       // Netscape 4.x javascript entities.
Chris@0:       [
Chris@0:         '<br size="&{alert(0)}">',
Chris@0:         'alert',
Chris@0:         'Netscape 4.x javascript entities.',
Chris@0:         ['br'],
Chris@0:       ],
Chris@0:       // DRUPAL-SA-2008-006: Invalid UTF-8, these only work as reflected XSS with
Chris@0:       // Internet Explorer 6.
Chris@0:       [
Chris@0:         "<p arg=\"\xe0\">\" style=\"background-image: url(javascript:alert(0));\"\xe0<p>",
Chris@0:         'style',
Chris@0:         'HTML filter -- invalid UTF-8.',
Chris@0:         ['p'],
Chris@0:       ],
Chris@0:     ];
Chris@0:     // @fixme This dataset currently fails under 5.4 because of
Chris@0:     //   https://www.drupal.org/node/1210798. Restore after its fixed.
Chris@0:     if (version_compare(PHP_VERSION, '5.4.0', '<')) {
Chris@0:       $cases[] = [
Chris@0:         '<img src=" &#14;  javascript:alert(0)">',
Chris@0:         'javascript',
Chris@0:         'HTML scheme clearing evasion -- spaces and metacharacters before scheme.',
Chris@0:         ['img'],
Chris@0:       ];
Chris@0:     }
Chris@0:     return $cases;
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Checks that invalid multi-byte sequences are rejected.
Chris@0:    *
Chris@0:    * @param string $value
Chris@0:    *   The value to filter.
Chris@0:    * @param string $expected
Chris@0:    *   The expected result.
Chris@0:    * @param string $message
Chris@0:    *   The assertion message to display upon failure.
Chris@0:    *
Chris@0:    * @dataProvider providerTestInvalidMultiByte
Chris@0:    */
Chris@0:   public function testInvalidMultiByte($value, $expected, $message) {
Chris@0:     $this->assertEquals(Xss::filter($value), $expected, $message);
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Data provider for testInvalidMultiByte().
Chris@0:    *
Chris@0:    * @see testInvalidMultiByte()
Chris@0:    *
Chris@0:    * @return array
Chris@0:    *   An array of arrays containing strings:
Chris@0:    *     - The value to filter.
Chris@0:    *     - The value to expect after filtering.
Chris@0:    *     - The assertion message.
Chris@0:    */
Chris@0:   public function providerTestInvalidMultiByte() {
Chris@0:     return [
Chris@0:       ["Foo\xC0barbaz", '', 'Xss::filter() accepted invalid sequence "Foo\xC0barbaz"'],
Chris@0:       ["Fooÿñ", "Fooÿñ", 'Xss::filter() rejects valid sequence Fooÿñ"'],
Chris@0:       ["\xc0aaa", '', 'HTML filter -- overlong UTF-8 sequences.'],
Chris@0:     ];
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Checks that strings starting with a question sign are correctly processed.
Chris@0:    */
Chris@0:   public function testQuestionSign() {
Chris@0:     $value = Xss::filter('<?xml:namespace ns="urn:schemas-microsoft-com:time">');
Chris@0:     $this->assertTrue(stripos($value, '<?xml') === FALSE, 'HTML tag stripping evasion -- starting with a question sign (processing instructions).');
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Check that strings in HTML attributes are correctly processed.
Chris@0:    *
Chris@0:    * @covers ::attributes
Chris@0:    * @dataProvider providerTestAttributes
Chris@0:    */
Chris@0:   public function testAttribute($value, $expected, $message, $allowed_tags = NULL) {
Chris@0:     $value = Xss::filter($value, $allowed_tags);
Chris@0:     $this->assertEquals($expected, $value, $message);
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Data provider for testFilterXssAdminNotNormalized().
Chris@0:    */
Chris@0:   public function providerTestAttributes() {
Chris@0:     return [
Chris@0:       [
Chris@0:         '<img src="http://example.com/foo.jpg" title="Example: title" alt="Example: alt">',
Chris@0:         '<img src="http://example.com/foo.jpg" title="Example: title" alt="Example: alt">',
Chris@0:         'Image tag with alt and title attribute',
Chris@17:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<a href="https://www.drupal.org/" rel="dc:publisher">Drupal</a>',
Chris@0:         '<a href="https://www.drupal.org/" rel="dc:publisher">Drupal</a>',
Chris@0:         'Link tag with rel attribute',
Chris@17:         ['a'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<span property="dc:subject">Drupal 8: The best release ever.</span>',
Chris@0:         '<span property="dc:subject">Drupal 8: The best release ever.</span>',
Chris@0:         'Span tag with property attribute',
Chris@17:         ['span'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<img src="http://example.com/foo.jpg" data-caption="Drupal 8: The best release ever.">',
Chris@0:         '<img src="http://example.com/foo.jpg" data-caption="Drupal 8: The best release ever.">',
Chris@0:         'Image tag with data attribute',
Chris@17:         ['img'],
Chris@0:       ],
Chris@0:       [
Chris@0:         '<a data-a2a-url="foo"></a>',
Chris@0:         '<a data-a2a-url="foo"></a>',
Chris@0:         'Link tag with numeric data attribute',
Chris@17:         ['a'],
Chris@0:       ],
Chris@0:     ];
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Checks that \Drupal\Component\Utility\Xss::filterAdmin() correctly strips unallowed tags.
Chris@0:    */
Chris@0:   public function testFilterXSSAdmin() {
Chris@0:     $value = Xss::filterAdmin('<style /><iframe /><frame /><frameset /><meta /><link /><embed /><applet /><param /><layer />');
Chris@0:     $this->assertEquals($value, '', 'Admin HTML filter -- should never allow some tags.');
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Tests the loose, admin HTML filter.
Chris@0:    *
Chris@0:    * @param string $value
Chris@0:    *   The value to filter.
Chris@0:    * @param string $expected
Chris@0:    *   The expected result.
Chris@0:    * @param string $message
Chris@0:    *   The assertion message to display upon failure.
Chris@0:    *
Chris@0:    * @dataProvider providerTestFilterXssAdminNotNormalized
Chris@0:    */
Chris@0:   public function testFilterXssAdminNotNormalized($value, $expected, $message) {
Chris@0:     $this->assertNotNormalized(Xss::filterAdmin($value), $expected, $message);
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Data provider for testFilterXssAdminNotNormalized().
Chris@0:    *
Chris@0:    * @see testFilterXssAdminNotNormalized()
Chris@0:    *
Chris@0:    * @return array
Chris@0:    *   An array of arrays containing strings:
Chris@0:    *     - The value to filter.
Chris@0:    *     - The value to expect after filtering.
Chris@0:    *     - The assertion message.
Chris@0:    */
Chris@0:   public function providerTestFilterXssAdminNotNormalized() {
Chris@0:     return [
Chris@0:       // DRUPAL-SA-2008-044
Chris@0:       ['<object />', 'object', 'Admin HTML filter -- should not allow object tag.'],
Chris@0:       ['<script />', 'script', 'Admin HTML filter -- should not allow script tag.'],
Chris@0:     ];
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Asserts that a text transformed to lowercase with HTML entities decoded does contain a given string.
Chris@0:    *
Chris@0:    * Otherwise fails the test with a given message, similar to all the
Chris@0:    * SimpleTest assert* functions.
Chris@0:    *
Chris@0:    * Note that this does not remove nulls, new lines and other characters that
Chris@0:    * could be used to obscure a tag or an attribute name.
Chris@0:    *
Chris@0:    * @param string $haystack
Chris@0:    *   Text to look in.
Chris@0:    * @param string $needle
Chris@0:    *   Lowercase, plain text to look for.
Chris@0:    * @param string $message
Chris@0:    *   (optional) Message to display if failed. Defaults to an empty string.
Chris@0:    * @param string $group
Chris@0:    *   (optional) The group this message belongs to. Defaults to 'Other'.
Chris@0:    */
Chris@0:   protected function assertNormalized($haystack, $needle, $message = '', $group = 'Other') {
Chris@0:     $this->assertTrue(strpos(strtolower(Html::decodeEntities($haystack)), $needle) !== FALSE, $message, $group);
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Asserts that text transformed to lowercase with HTML entities decoded does not contain a given string.
Chris@0:    *
Chris@0:    * Otherwise fails the test with a given message, similar to all the
Chris@0:    * SimpleTest assert* functions.
Chris@0:    *
Chris@0:    * Note that this does not remove nulls, new lines, and other character that
Chris@0:    * could be used to obscure a tag or an attribute name.
Chris@0:    *
Chris@0:    * @param string $haystack
Chris@0:    *   Text to look in.
Chris@0:    * @param string $needle
Chris@0:    *   Lowercase, plain text to look for.
Chris@0:    * @param string $message
Chris@0:    *   (optional) Message to display if failed. Defaults to an empty string.
Chris@0:    * @param string $group
Chris@0:    *   (optional) The group this message belongs to. Defaults to 'Other'.
Chris@0:    */
Chris@0:   protected function assertNotNormalized($haystack, $needle, $message = '', $group = 'Other') {
Chris@0:     $this->assertTrue(strpos(strtolower(Html::decodeEntities($haystack)), $needle) === FALSE, $message, $group);
Chris@0:   }
Chris@0: 
Chris@0: }