r12504 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:< r12503‎ | r12504 | r12505 >
Date:10:33, 8 January 2006
Author:avar
Status:old
Tags:
Comment:
* More <!-- comment --> tests, two of which fail
* Two tests for hex sequences in links, one of which fails
* moved all the XSS tests to one place
* More & improved parser hook tests
Modified paths:
  • /trunk/phase3/maintenance/parserTests.txt (modified) (history)

Diff [purge]

Index: trunk/phase3/maintenance/parserTests.txt
——@@ -16,6 +16,7 @@
1717 # cat add category links
1818 # ill add inter-language links
1919 # subpage enable subpages (disabled by default)
 20+# noxml don't check for XML well formdness
2021 # title=[[XXX]] run test using article title XXX
2122 # disabled do not run test
2223 #
——@@ -218,6 +219,51 @@
219220 </p>
220221 !! end
221222
 223+!! test
 224+Comment whitespace
 225+!! input
 226+<!-- returns a single newline, not nothing, since the newline after > is not stripped -->
 227+!! result
 228+
 229+!! end
 230+
 231+!! test
 232+Comment semantics and delimiters
 233+!! input
 234+<!-- --><!----><!-----><!------>
 235+!! result
 236+
 237+!! end
 238+
 239+!! test
 240+Comment semantics and delimiters, redux
 241+!! input
 242+<!-- In SGML every "foo" here would actually show up in the text -- foo -- bar
 243+-- foo -- funky huh? ... -->
 244+!! result
 245+
 246+!! end
 247+
 248+!! test
 249+Comment semantics and delimiters: directors cut
 250+!! input
 251+<!-- ... However we're purely an XML shop you see, so we eat everything
 252+starting with < followed by !-- until the first -- and > we see, observe: -->-->
 253+!! result
 254+<p>--&gt;
 255+</p>
 256+!! end
 257+
 258+!! test
 259+Comment semantics: nesting
 260+!! input
 261+<!--<!-- no, we're not going to do anything fancy here -->-->
 262+!! result
 263+<p>--&gt;
 264+</p>
 265+!! end
 266+
 267+
222268 ###
223269 ### Preformatted text
224270 ###
——@@ -1014,6 +1060,24 @@
10151061 !!end
10161062
10171063 !! test
 1064+Link containing "#<" and "#>" % as a hex sequences
 1065+!! input
 1066+[[%23%3c]]<!-- Render this as "[[#%3c]]" maybe.. ? -->[[%23%3e]]<!-- ..."[[#%3e]]" ? -->
 1067+!! result
 1068+<p>[[%23%3c]][[%23%3e]]
 1069+</p>
 1070+!! end
 1071+
 1072+!! test
 1073+Link containing "<#" and ">#" as a hex sequences
 1074+!! input
 1075+[[%3c%23]][[%3e%23]]
 1076+!! result
 1077+<p>[[%3c%23]][[%3e%23]]
 1078+</p>
 1079+!! end
 1080+
 1081+!! test
10181082 Plain link to URL
10191083 !! input
10201084 [[http://www.example.org]]
——@@ -2778,6 +2842,7 @@
27792843
27802844 !! end
27812845
 2846+
27822847 !! test
27832848 Bug 2304: HTML attribute safety (ISBN)
27842849 !! input
——@@ -2841,7 +2906,6 @@
28422907
28432908 !! end
28442909
2845 -
28462910 !! test
28472911 Math section safety when disabled
28482912 !! input
——@@ -2851,8 +2915,46 @@
28522916 </p>
28532917 !! end
28542918
 2919+# More MSIE fun discovered by Tom Gilder
28552920
28562921 !! test
 2922+MSIE CSS safety test: spurious slash
 2923+!! input
 2924+<div style="background-image:u\rl(javascript:alert('boo'))">evil</div>
 2925+!! result
 2926+<div>evil</div>
 2927+
 2928+!! end
 2929+
 2930+!! test
 2931+MSIE CSS safety test: hex code
 2932+!! input
 2933+<div style="background-image:u\72l(javascript:alert('boo'))">evil</div>
 2934+!! result
 2935+<div>evil</div>
 2936+
 2937+!! end
 2938+
 2939+!! test
 2940+MSIE CSS safety test: comment in url
 2941+!! input
 2942+<div style="background-image:u/**/rl(javascript:alert('boo'))">evil</div>
 2943+!! result
 2944+<div style="background-image:u rl(javascript:alert('boo'))">evil</div>
 2945+
 2946+!! end
 2947+
 2948+!! test
 2949+MSIE CSS safety test: comment in expression
 2950+!! input
 2951+<div style="background-image:expres/**/sion(alert('boo4'))">evil4</div>
 2952+!! result
 2953+<div style="background-image:expres sion(alert('boo4'))">evil4</div>
 2954+
 2955+!! end
 2956+
 2957+
 2958+!! test
28572959 Table attribute legitimate extension
28582960 !! input
28592961 {|
——@@ -2881,46 +2983,107 @@
28822984 !! end
28832985
28842986 ###
2885 -### Parser hooks
 2987+### Parser hooks (see maintenance/parserTestsParserHook.php for the <tag> extension)
28862988 ###
28872989 !! test
28882990 Parser hook: empty input
28892991 !! input
28902992 <tag></tag>
28912993 !! result
 2994+<pre>
 2995+string(0) ""
 2996+array(0) {
 2997+}
 2998+</pre>
 2999+
28923000 !! end
28933001
28943002 !! test
 3003+Parser hook: empty input using terminated empty elements
 3004+!! input
 3005+<tag/>
 3006+!! result
 3007+<pre>
 3008+NULL
 3009+array(0) {
 3010+}
 3011+</pre>
 3012+
 3013+!! end
 3014+
 3015+!! test
28953016 Parser hook: basic input
28963017 !! input
28973018 <tag>input</tag>
28983019 !! result
2899 -<p>input
2900 -</p>
 3020+<pre>
 3021+string(5) "input"
 3022+array(0) {
 3023+}
 3024+</pre>
 3025+
29013026 !! end
29023027
 3028+
29033029 !! test
29043030 Parser hook: case insensetive
29053031 !! input
 3032+<TAG>input</TAG>
 3033+!! result
 3034+<pre>
 3035+string(5) "input"
 3036+array(0) {
 3037+}
 3038+</pre>
 3039+
 3040+!! end
 3041+
 3042+
 3043+!! test
 3044+Parser hook: case insensetive, redux
 3045+!! input
29063046 <TaG>input</TAg>
29073047 !! result
2908 -<p>input
2909 -</p>
 3048+<pre>
 3049+string(5) "input"
 3050+array(0) {
 3051+}
 3052+</pre>
 3053+
29103054 !! end
29113055
29123056 !! test
 3057+Parser hook: nested tags
 3058+!! options
 3059+noxml
 3060+!! input
 3061+<tag><tag></tag></tag>
 3062+!! result
 3063+<pre>
 3064+string(5) "<tag>"
 3065+array(0) {
 3066+}
 3067+</pre>&lt;/tag&gt;
 3068+
 3069+!! end
 3070+
 3071+!! test
29133072 Parser hook: basic arguments
29143073 !! input
29153074 <tag width=200 height = "100" depth = '50' square></tag>
29163075 !! result
29173076 <pre>
2918 -Array
2919 -(
2920 - [width] => 200
2921 - [height] => 100
2922 - [depth] => 50
2923 - [square] => square
2924 -)
 3077+string(0) ""
 3078+array(4) {
 3079+ ["width"]=>
 3080+ string(3) "200"
 3081+ ["height"]=>
 3082+ string(3) "100"
 3083+ ["depth"]=>
 3084+ string(2) "50"
 3085+ ["square"]=>
 3086+ string(6) "square"
 3087+}
29253088 </pre>
29263089
29273090 !! end
——@@ -2931,12 +3094,13 @@
29323095 <tag foo=bar/>text
29333096 !! result
29343097 <pre>
2935 -Array
2936 -(
2937 - [foo] => bar
2938 -)
2939 -</pre>
2940 -text
 3098+NULL
 3099+array(1) {
 3100+ ["foo"]=>
 3101+ string(3) "bar"
 3102+}
 3103+</pre>text
 3104+
29413105 !! end
29423106
29433107 # </tag> should be output literally since there is no matching tag that begins it
——@@ -2948,17 +3112,21 @@
29493113 </tag>
29503114 !! result
29513115 <pre>
2952 -Array
2953 -(
2954 - [width] => 200
2955 - [height] => 100
2956 - [depth] => 50
2957 - [square] => square
2958 -)
 3116+NULL
 3117+array(4) {
 3118+ ["width"]=>
 3119+ string(3) "200"
 3120+ ["height"]=>
 3121+ string(3) "100"
 3122+ ["depth"]=>
 3123+ string(2) "50"
 3124+ ["square"]=>
 3125+ string(6) "square"
 3126+}
29593127 </pre>
2960 -other stuff
2961 -</tag>
2962 -
 3128+<p>other stuff
 3129+&lt;/tag&gt;
 3130+</p>
29633131 !! end
29643132
29653133
——@@ -2987,44 +3155,6 @@
29883156 !! end
29893157
29903158
2991 -# More MSIE fun discovered by Tom Gilder
2992 -
2993 -!! test
2994 -MSIE CSS safety test: spurious slash
2995 -!! input
2996 -<div style="background-image:u\rl(javascript:alert('boo'))">evil</div>
2997 -!! result
2998 -<div>evil</div>
2999 -
3000 -!! end
3001 -
3002 -!! test
3003 -MSIE CSS safety test: hex code
3004 -!! input
3005 -<div style="background-image:u\72l(javascript:alert('boo'))">evil</div>
3006 -!! result
3007 -<div>evil</div>
3008 -
3009 -!! end
3010 -
3011 -!! test
3012 -MSIE CSS safety test: comment in url
3013 -!! input
3014 -<div style="background-image:u/**/rl(javascript:alert('boo'))">evil</div>
3015 -!! result
3016 -<div style="background-image:u rl(javascript:alert('boo'))">evil</div>
3017 -
3018 -!! end
3019 -
3020 -!! test
3021 -MSIE CSS safety test: comment in expression
3022 -!! input
3023 -<div style="background-image:expres/**/sion(alert('boo4'))">evil4</div>
3024 -!! result
3025 -<div style="background-image:expres sion(alert('boo4'))">evil4</div>
3026 -
3027 -!! end
3028 -
30293159 ###
30303160 ### Sanitizer
30313161 ###

Status & tagging log