Cure53 expanding tests (#1310)

cure53 · web-flow · commit 4b76e03c09a0 · 2026-04-23T11:11:28.000+02:00
* test: expanded test coverage for form clobbering and type confusions
* test: removed some outdated comments in test suite
diff --git a/test/test-suite.js b/test/test-suite.js
@@ -2856,5 +2856,325 @@
         }
       }
     );
+
+    /* ====================================================================
+     * Claim-validation tests for the 5 findings in Dompurify_finding.md
+     * and the 8 DoS payloads in Dompurify_exceptions.md.
+     *
+     * Pass/fail semantics:
+     *   - PASS = claim does NOT reproduce (DOMPurify is safe or already fixed)
+     *   - FAIL = claim reproduces (real issue present, needs a patch)
+     *
+     * Drop this block into test/test-suite.js just before the closing
+     *     };
+     *   });
+     * at the end of the file. Then `npm test` (or npm run test:jsdom) will
+     * include it.
+     *
+     * If the browser and jsdom disagree, that itself is useful info.
+     * ==================================================================== */
+
+    QUnit.module('Finding #1: _forceRemove DoS (Dompurify_exceptions.md)');
+
+    /* Eight payloads from Dompurify_exceptions.md. Each claim is that
+     * sanitize() throws — a real exception escaping the call site, which
+     * a caller would see as a DoS. If any of these throws, finding #1
+     * reproduces and needs a patch (wrap the final remove() call at
+     * purify.ts:932 in a second try/catch, or use remove() as the primary
+     * path instead of parent.removeChild).
+     *
+     * Implementation note: we compare against a sentinel object so we
+     * distinguish "threw" from "returned undefined/empty string". */
+    const DOS_PAYLOADS = [
+      {
+        title:
+          'HTML: form with clobbered firstElementChild + innerHTML + textContent',
+        payload:
+          '<form><input name=firstElementChild><input name=innerHTML><input name=textContent></form>',
+        config: {},
+      },
+      {
+        title: 'HTML: form with clobbered attributes (single input)',
+        payload: '<form><input name=attributes></form>',
+        config: {},
+      },
+      {
+        title: 'HTML: form with clobbered attributes (two inputs)',
+        payload: '<form><input name=attributes><input name=attributes></form>',
+        config: {},
+      },
+      {
+        title: 'HTML: form onclick + clobbered attributes (two inputs)',
+        payload:
+          '<form onclick=alert(1)><input name=attributes><input name=attributes></form>',
+        config: {},
+      },
+      {
+        title: 'XHTML: form with CDATA (mXSS regexes both match)',
+        payload: '<form id="f"><![CDATA[<img src=x onerror=alert(1)>]]></form>',
+        config: { PARSER_MEDIA_TYPE: 'application/xhtml+xml' },
+      },
+      {
+        title:
+          'XHTML: form with text + PI (textContent + innerHTML regexes match)',
+        payload: '<form id="f">&lt;a<?x <img src=x onerror=alert(1)?></form>',
+        config: { PARSER_MEDIA_TYPE: 'application/xhtml+xml' },
+      },
+      {
+        title: 'XHTML: form with text + CDATA',
+        payload:
+          '<form id="f">&lt;a<![CDATA[<img src=x onerror=alert(1)>]]></form>',
+        config: { PARSER_MEDIA_TYPE: 'application/xhtml+xml' },
+      },
+      {
+        title: 'XHTML: form with PI + CDATA',
+        payload:
+          '<form id="f"><?a <x?><![CDATA[<img onerror=alert(1)>]]></form>',
+        config: { PARSER_MEDIA_TYPE: 'application/xhtml+xml' },
+      },
+    ];
+
+    DOS_PAYLOADS.forEach((tc) => {
+      QUnit.test(`#1 DoS: ${tc.title}`, (assert) => {
+        let threw = false;
+        let errorMsg = '';
+        let result;
+        try {
+          result = DOMPurify.sanitize(tc.payload, tc.config);
+        } catch (e) {
+          threw = true;
+          errorMsg = (e && (e.stack || e.message)) || String(e);
+        }
+        assert.notOk(
+          threw,
+          threw
+            ? `REPRODUCES — sanitize() threw:\n  ${errorMsg}`
+            : `safe — sanitize() returned: ${JSON.stringify(result)}`
+        );
+      });
+    });
+
+    QUnit.module('Finding #1 bonus: sanitize-for is robust under clobbering');
+
+    /* Even if sanitize() returns safely, confirm the clobbering payload
+     * doesn't leave dangerous residue. These assertions are advisory;
+     * the DoS test above is the primary signal. */
+    QUnit.test(
+      '#1: HTML form-clobber output contains no event handler',
+      (assert) => {
+        const out = DOMPurify.sanitize(
+          '<form onclick=alert(1)><input name=attributes><input name=attributes></form>'
+        );
+        assert.notOk(/onclick/i.test(out), `output retains onclick: ${out}`);
+      }
+    );
+
+    QUnit.module(
+      'Finding #2: attribute-breakout regex coverage (listing/plaintext)'
+    );
+
+    function attrValueAfterSanitize(input, attrName) {
+      const clean = DOMPurify.sanitize(input);
+      const probe = document.createElement('div');
+      probe.innerHTML = clean;
+      const el = probe.querySelector('[' + attrName + ']');
+      return el ? el.getAttribute(attrName) : null;
+    }
+
+    QUnit.test(
+      '#2 control: </style> IS stripped (regex works for listed tags)',
+      (assert) => {
+        const value = attrValueAfterSanitize(
+          '<a title="x</style>y">z</a>',
+          'title'
+        );
+        assert.notOk(
+          value && /<\/style>/i.test(value),
+          value
+            ? `control failed: title retained </style>: "${value}"`
+            : 'control passed: </style> stripped'
+        );
+      }
+    );
+
+    QUnit.module('Finding #3: _isClobbered coverage (informational)');
+
+    /* Hardening: extend _isClobbered to cover firstElementChild, innerHTML,
+     * nodeType, tagName. No direct observable bug; the values feed the
+     * mXSS check at line 1138–1146, currently contained by defense in
+     * depth. Nothing to test beyond #1's DoS suite — those payloads cover
+     * whether clobbering these properties produces an observable crash. */
+    QUnit.test('#3: informational — covered by #1 DoS suite', (assert) => {
+      assert.ok(true, 'no additional test — see Finding #1 DoS results above');
+    });
+
+    QUnit.module('Finding #4: external form= association');
+
+    /* Claim: <form id=f></form><input form=f name=X> clobbers from outside
+     * the form's subtree. _isClobbered still catches the form itself (it
+     * checks property types, not child presence), but the clobbering
+     * input survives as a sibling.
+     *
+     * Test: after sanitize, does the clobbering NAME survive? SANITIZE_DOM
+     * should strip it (default is true). If it survives, the primitive is
+     * open. If stripped, only the form= attribute itself is left — which
+     * is the hardening recommendation #4a. */
+    QUnit.test(
+      '#4: HTML — name="firstElementChild" on stray input is stripped',
+      (assert) => {
+        const out = DOMPurify.sanitize(
+          '<form id="f"></form><input form="f" name="firstElementChild">'
+        );
+        const nameSurvived = /name\s*=\s*["']?firstElementChild/i.test(out);
+        assert.notOk(
+          nameSurvived,
+          nameSurvived
+            ? `REPRODUCES — name="firstElementChild" survived SANITIZE_DOM. Output: ${out}`
+            : `safe — SANITIZE_DOM stripped the clobbering name. Output: ${out}`
+        );
+      }
+    );
+
+    QUnit.test(
+      '#4: XHTML — name="firstElementChild" on stray input is stripped',
+      (assert) => {
+        const out = DOMPurify.sanitize(
+          '<form id="f"><![CDATA[<x>]]></form><input form="f" name="firstElementChild"/>',
+          { PARSER_MEDIA_TYPE: 'application/xhtml+xml' }
+        );
+        const nameSurvived = /name\s*=\s*["']?firstElementChild/i.test(out);
+        assert.notOk(
+          nameSurvived,
+          nameSurvived
+            ? `REPRODUCES — name="firstElementChild" survived in XHTML. Output: ${out}`
+            : `safe — name stripped in XHTML. Output: ${out}`
+        );
+      }
+    );
+
+    QUnit.test(
+      '#4 informational: form= attribute presence in output',
+      (assert) => {
+        const out = DOMPurify.sanitize(
+          '<form id="f"></form><input form="f" name="firstElementChild">'
+        );
+        const formAttrSurvived = /\sform\s*=/i.test(out);
+        // This is purely informational. #4a recommends stripping form=
+        // attributes unconditionally via _isValidAttribute. This assertion
+        // passes either way — it just records which state the code is in.
+        assert.ok(
+          true,
+          `INFO — form= attribute ${formAttrSurvived ? 'survived' : 'was stripped'}. Output: ${out}`
+        );
+      }
+    );
+
+    QUnit.module(
+      'Bypass claim: style + XHTML + RETURN_DOM_FRAGMENT round-trip'
+    );
+
+    /* User-provided snippet:
+     *
+     *   const clean = DOMPurify.sanitize(
+     *     '<style>&lt;/style&gt;&lt;img src=x onerror=alert(1)&gt;<a></a></style>',
+     *     { PARSER_MEDIA_TYPE: 'application/xhtml+xml', RETURN_DOM_FRAGMENT: true }
+     *   );
+     */
+
+    QUnit.test(
+      'bypass: reparsed fragment contains no <img onerror> after round-trip',
+      (assert) => {
+        const payload =
+          '<style>&lt;/style&gt;&lt;img src=x onerror=alert(1)&gt;<a></a></style>';
+
+        let clean;
+        try {
+          clean = DOMPurify.sanitize(payload, {
+            PARSER_MEDIA_TYPE: 'application/xhtml+xml',
+            RETURN_DOM_FRAGMENT: true,
+          });
+        } catch (e) {
+          assert.ok(false, `sanitize() threw: ${e && e.message}`);
+          return;
+        }
+
+        const div = document.createElement('div');
+        div.appendChild(clean);
+        const roundTripped = div.innerHTML;
+
+        // Reparse the serialized HTML in a detached div to see what a
+        // downstream consumer assigning it via innerHTML would get.
+        const probe = document.createElement('div');
+        probe.innerHTML = roundTripped;
+
+        const imgs = probe.querySelectorAll('img');
+        const dangerous = Array.prototype.some.call(imgs, (img) =>
+          img.hasAttribute('onerror')
+        );
+
+        assert.notOk(
+          dangerous,
+          dangerous
+            ? `REPRODUCES — reparsed DOM has <img onerror>. Round-trip HTML: ${roundTripped}`
+            : `safe — round-trip HTML: ${roundTripped}`
+        );
+      }
+    );
+
+    QUnit.test(
+      'bypass: string sanitize (no FRAGMENT) of the same payload is safe',
+      (assert) => {
+        const payload =
+          '<style>&lt;/style&gt;&lt;img src=x onerror=alert(1)&gt;<a></a></style>';
+        const out = DOMPurify.sanitize(payload, {
+          PARSER_MEDIA_TYPE: 'application/xhtml+xml',
+        });
+        // We should see no <img> and no onerror in the output. The <style>
+        // element should be stripped entirely by the #1150-1158 check.
+        assert.notOk(
+          /<img/i.test(out) || /onerror/i.test(out),
+          `string sanitize output: ${out}`
+        );
+      }
+    );
+
+    QUnit.test(
+      'bypass: XSS native — alert() must not fire after round-trip',
+      (assert) => {
+        const done = assert.async();
+        const payload =
+          '<style>&lt;/style&gt;&lt;img src=x onerror=alert(1)&gt;<a></a></style>';
+
+        let clean;
+        try {
+          clean = DOMPurify.sanitize(payload, {
+            PARSER_MEDIA_TYPE: 'application/xhtml+xml',
+            RETURN_DOM_FRAGMENT: true,
+          });
+        } catch (e) {
+          assert.ok(false, `sanitize() threw: ${e && e.message}`);
+          done();
+          return;
+        }
+
+        const div = document.createElement('div');
+        div.appendChild(clean);
+
+        // Scoped container — don't taint document.body if XSS were to fire.
+        const container = document.getElementById('qunit-fixture');
+        container.innerHTML = div.innerHTML;
+
+        setTimeout(() => {
+          assert.notEqual(
+            window.xssed,
+            true,
+            'alert() fired via XHTML-style round-trip (bypass reproduces)'
+          );
+          container.innerHTML = '';
+          window.xssed = false;
+          done();
+        }, 100);
+      }
+    );
   };
 });
