jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

make sure that markdown uses safe mode (#2961)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-19 23:07:27 +01:00
committed by GitHub
parent 9470699798
commit 76e09447c8
4 changed files with 39 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/Twig/Runtime/MarkdownExtensionTest.php
View File

@@ -27,6 +27,10 @@ class MarkdownExtensionTest extends TestCase
$sut = new MarkdownExtension(new Markdown(), $config);
$this->assertEquals('<p><em>test</em></p>', $sut->markdownToHtml('*test*'));
$this->assertEquals('<p># foobar</p>', $sut->markdownToHtml('# foobar'));
$this->assertEquals(
'<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
$sut->markdownToHtml('[XSS](javascript:alert(`XSS`))')
);
}
public function testTimesheetContent()
@@ -47,6 +51,10 @@ class MarkdownExtensionTest extends TestCase
"<ul>\n<li>test</li>\n<li>foo</li>\n</ul>\n<p>foo <strong>bar</strong></p>",
$sut->timesheetContent("- test\n- foo\n\nfoo __bar__")
);
$this->assertEquals(
'<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
$sut->timesheetContent('[XSS](javascript:alert(`XSS`))')
);
}
public function testCommentContent()
@@ -76,6 +84,10 @@ class MarkdownExtensionTest extends TestCase
"<ul>\n<li>test</li>\n<li>foo</li>\n</ul>\n<p>foo <strong>bar</strong></p>",
$sut->commentContent("- test\n- foo\n\nfoo __bar__")
);
$this->assertEquals(
'<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
$sut->commentContent('[XSS](javascript:alert(`XSS`))')
);
}
public function testCommentOneLiner()

18
tests/Utils/MarkdownTest.php
View File

@@ -81,6 +81,24 @@ EOT;
## test
### test
# test
EOT;
$this->assertEquals($html, $sut->toHtml($markdown));
}
public function testLinksAreSanitized()
{
$sut = new Markdown();
$html = <<<'EOT'
<p><a href="javascript%3Aalert(`XSS`)">XSS</a><br />
<a href="javascript%3Aalert(&quot;XSS&quot;)">XSS</a><br />
<a href="javascript%3Aalert(&#039;XSS&#039;)">XSS</a></p>
EOT;
$markdown = <<<EOT
[XSS](javascript:alert(`XSS`))
[XSS](javascript:alert("XSS"))
[XSS](javascript:alert('XSS'))
EOT;
$this->assertEquals($html, $sut->toHtml($markdown));
}