X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=test%2Fhtml_test.exs;h=08738276eb02e28d70cd99b527da89ddbf5fc30f;hb=0e2c215a006c7ca5756e80a357ff6395a4325946;hp=f7150759bb9d31ef75cf5b9671cddb32bb30cf46;hpb=3193423be9f288b186fe97997228aae84a8e730c;p=akkoma

diff --git a/test/html_test.exs b/test/html_test.exs
index f7150759b..08738276e 100644
--- a/test/html_test.exs
+++ b/test/html_test.exs
@@ -1,3 +1,7 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
 defmodule Pleroma.HTMLTest do
   alias Pleroma.HTML
   use Pleroma.DataCase
@@ -6,6 +10,8 @@ defmodule Pleroma.HTMLTest do
     <b>this is in bold</b>
     <p>this is a paragraph</p>
     this is a linebreak<br />
+    this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
+    this is a link with not allowed "rel" attribute: <a href="http://example.com/" rel="tag noallowed">example.com</a>
     this is an image: <img src="http://example.com/image.jpg"><br />
     <script>alert('hacked')</script>
   """
@@ -14,12 +20,26 @@ defmodule Pleroma.HTMLTest do
     <img src="http://example.com/image.jpg" onerror="alert('hacked')">
   """
 
+  @html_span_class_sample """
+    <span class="animate-spin">hi</span>
+  """
+
+  @html_span_microformats_sample """
+    <span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
+  """
+
+  @html_span_invalid_microformats_sample """
+    <span class="h-card"><a class="u-url mention animate-spin">@<span>foo</span></a></span>
+  """
+
   describe "StripTags scrubber" do
     test "works as expected" do
       expected = """
       this is in bold
         this is a paragraph
         this is a linebreak
+        this is a link with allowed "rel" attribute: example.com
+        this is a link with not allowed "rel" attribute: example.com
         this is an image: 
         alert('hacked')
       """
@@ -40,6 +60,8 @@ defmodule Pleroma.HTMLTest do
       this is in bold
         <p>this is a paragraph</p>
         this is a linebreak<br />
+        this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
+        this is a link with not allowed "rel" attribute: <a href="http://example.com/">example.com</a>
         this is an image: <img src="http://example.com/image.jpg" /><br />
         alert('hacked')
       """
@@ -54,6 +76,36 @@ defmodule Pleroma.HTMLTest do
 
       assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.TwitterText)
     end
+
+    test "does not allow spans with invalid classes" do
+      expected = """
+      <span>hi</span>
+      """
+
+      assert expected ==
+               HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.TwitterText)
+    end
+
+    test "does allow microformats" do
+      expected = """
+      <span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
+      """
+
+      assert expected ==
+               HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.TwitterText)
+    end
+
+    test "filters invalid microformats markup" do
+      expected = """
+      <span class="h-card"><a>@<span>foo</span></a></span>
+      """
+
+      assert expected ==
+               HTML.filter_tags(
+                 @html_span_invalid_microformats_sample,
+                 Pleroma.HTML.Scrubber.TwitterText
+               )
+    end
   end
 
   describe "default scrubber" do
@@ -62,6 +114,8 @@ defmodule Pleroma.HTMLTest do
       <b>this is in bold</b>
         <p>this is a paragraph</p>
         this is a linebreak<br />
+        this is a link with allowed "rel" attribute: <a href="http://example.com/" rel="tag">example.com</a>
+        this is a link with not allowed "rel" attribute: <a href="http://example.com/">example.com</a>
         this is an image: <img src="http://example.com/image.jpg" /><br />
         alert('hacked')
       """
@@ -76,5 +130,34 @@ defmodule Pleroma.HTMLTest do
 
       assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.Default)
     end
+
+    test "does not allow spans with invalid classes" do
+      expected = """
+      <span>hi</span>
+      """
+
+      assert expected == HTML.filter_tags(@html_span_class_sample, Pleroma.HTML.Scrubber.Default)
+    end
+
+    test "does allow microformats" do
+      expected = """
+      <span class="h-card"><a class="u-url mention">@<span>foo</span></a></span>
+      """
+
+      assert expected ==
+               HTML.filter_tags(@html_span_microformats_sample, Pleroma.HTML.Scrubber.Default)
+    end
+
+    test "filters invalid microformats markup" do
+      expected = """
+      <span class="h-card"><a>@<span>foo</span></a></span>
+      """
+
+      assert expected ==
+               HTML.filter_tags(
+                 @html_span_invalid_microformats_sample,
+                 Pleroma.HTML.Scrubber.Default
+               )
+    end
   end
 end