loofah/test/unit/test_acts_as_loofah.rb at a397edaf61286b685bcfbf6e53254dd683a5efad · flavorjones/loofah · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# frozen_string_literal: true

require "helper"

class UnitTestActsAsLoofah < Loofah::TestCase
  SUBJECTS = [Nokogiri::XML, Nokogiri::HTML4, defined?(Nokogiri::HTML5) && Nokogiri::HTML5].compact

  SUBJECTS.each do |subject|
    describe subject do
      it "Document act like Loofah" do
        ndoc = subject::Document.parse("<html><body><div>hello</div><span>hello</span><script>alert(1)</script></body></html>")
        node = ndoc.at_css("div")

        # method presence
        refute_respond_to(ndoc, :scrub!)
        refute_respond_to(node, :scrub!)

        ndoc.acts_as_loofah

        assert_respond_to(ndoc, :scrub!, "#{subject}::Document should be extended")
        assert_respond_to(ndoc.at_css("span"), :scrub!, "New child elements should be extended")
        assert_respond_to(node, :scrub!, "Existing child elements should be extended")

        refute_respond_to(subject::Document.parse("<div>"), :scrub!, "Other instances should not be extended")

        # scrub behavior
        ndoc.scrub!(:prune)

        refute_includes(ndoc.to_html, "script")

        # other concerns
        if subject.name.include?("HTML")
          assert_includes(ndoc.singleton_class.ancestors, Loofah::TextBehavior)
          assert_includes(ndoc.singleton_class.ancestors, Loofah::HtmlDocumentBehavior)
        end
      end

      it "DocumentFragment act like Loofah" do
        nfrag = subject::DocumentFragment.parse("<div>hello</div><span>hello</span><script>alert(1)</script>")
        node = nfrag.at_css("div")

        # method presence
        refute_respond_to(nfrag, :scrub!)
        refute_respond_to(node, :scrub!)

        nfrag.acts_as_loofah

        assert_respond_to(nfrag, :scrub!, "#{subject}::DocumentFragment should be extended")
        assert_respond_to(nfrag.at_css("span"), :scrub!, "New child elements should be extended")
        assert_respond_to(node, :scrub!, "Existing child elements should be extended")

        refute_respond_to(subject::DocumentFragment.parse("<div>"), :scrub!, "Other instances should not be extended")

        # scrub behavior
        nfrag.scrub!(:prune)

        refute_includes(nfrag.to_html, "script")

        # other concerns
        if subject.name.include?("HTML")
          assert_includes(nfrag.singleton_class.ancestors, Loofah::TextBehavior)
          assert_includes(nfrag.singleton_class.ancestors, Loofah::HtmlFragmentBehavior)
        end
      end
    end
  end
end