default pattern のサニタイズのあと、HTMLPurifier によって完全に削除される場合があるテストを修正

nanasess · Nov 22, 2024 · 05ed598 · 05ed598
1 parent f942d2b
commit 05ed598
Showing 1 changed file with 29 additions and 28 deletions.
diff --git a/tests/class/modifier/Modifier_ScriptEscapeTest.php b/tests/class/modifier/Modifier_ScriptEscapeTest.php
@@ -11,33 +11,34 @@ class Modifier_ScriptEscapeTest extends PHPUnit_Framework_TestCase
 {
     public function scriptEscapeProvider()
     {
+        $default_pattern = '/#script escaped#/';
         return [
-            ['<script type="text/javascript"></script>'],
-            ['<svg onload="alert(1)">test</svg>'],
-            ['<img onload="alert(1)">test</img>'],
-            ['<body onload="alert(1)">test</body>'],
-            ['<iframe></iframe>'],
-            ['<object></object>'],
-            ['<embed>'],
-            ['\"onclick=\"alert(1)\"'],
-            ['<p onclick="alert(1)">test</p>'],
-            ['<p onsubmit="alert(1)">test</p>'],
-            ['<p style="" onclick="alert(1)">test</p>'],
-            ['<input type="button"onfocus="alert(1)">'],
-            ['<input type="button" onblur="alert(1)">'],
-            ['<input onfocus="alert(1)" type="button">'],
-            ['<body onresize="alert(1)">'],
-            ['<div onscroll="alert(1)">'],
-            ['<div>javascript:test()</div>'],
-            ['<input type="button" ondblclick="alert(1)">'],
-            ['<input type="text" onchange="alert(1);">'],
-            ['<input type="text" onselect="alert(1);">'],
-            ['<form onsubmit="alert(1);">'],
-            ['<input type="button" onkeydown="alert(1)">'],
-            ['<input type="button" onkeypress="alert(1)">'],
-            ['<input type="button" onkeyup="alert(1)">'],
-            ['<input type=\"button\"\nonclick=\"alert(1)\">'],
-            ['<div/onscroll="alert(1)">'],
+            ['<script type="text/javascript"></script>', $default_pattern],
+            ['<svg onload="alert(1)">test</svg>', $default_pattern],
+            ['<img onload="alert(1)">test</img>', $default_pattern],
+            ['<body onload="alert(1)">test</body>', $default_pattern],
+            ['<iframe></iframe>', $default_pattern],
+            ['<object></object>', $default_pattern],
+            ['<embed>', $default_pattern],
+            ['\"onclick=\"alert(1)\"', $default_pattern],
+            ['<p onclick="alert(1)">test</p>', $default_pattern],
+            ['<p onsubmit="alert(1)">test</p>', $default_pattern],
+            ['<p style="" onclick="alert(1)">test</p>', $default_pattern],
+            ['<input type="button"onfocus="alert(1)">', '//'], // HTMLPurifier によって完全に削除される
+            ['<input type="button" onblur="alert(1)">', $default_pattern],
+            ['<input onfocus="alert(1)" type="button">', $default_pattern],
+            ['<body onresize="alert(1)">', $default_pattern],
+            ['<div onscroll="alert(1)">', $default_pattern],
+            ['<div>javascript:test()</div>', $default_pattern],
+            ['<input type="button" ondblclick="alert(1)">', $default_pattern],
+            ['<input type="text" onchange="alert(1);">', $default_pattern],
+            ['<input type="text" onselect="alert(1);">', $default_pattern],
+            ['<form onsubmit="alert(1);">', $default_pattern],
+            ['<input type="button" onkeydown="alert(1)">', $default_pattern],
+            ['<input type="button" onkeypress="alert(1)">', $default_pattern],
+            ['<input type="button" onkeyup="alert(1)">', $default_pattern],
+            ['<input type=\"button\"\nonclick=\"alert(1)\">', '//'], // HTMLPurifier によって完全に削除される
+            ['<div/onscroll="alert(1)">', $default_pattern],
         ];
     }
 
@@ -58,10 +59,10 @@ public function scriptNoEscapeProvider()
     /**
      * @dataProvider scriptEscapeProvider
      */
-    public function testメールテンプレートエスケープされる($value)
+    public function testメールテンプレートエスケープされる($value, $pattern)
     {
         $ret = smarty_modifier_script_escape($value);
-        $pattern = '/#script escaped#/';
+        var_dump($ret);
         $this->assertMatchesRegularExpression($pattern, $ret);
     }