X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/e91ef54cc9f8ce6b264bced8191275b6a33e594f..refs/pull/3593/head:/tests/Entity/PageContentTest.php diff --git a/tests/Entity/PageContentTest.php b/tests/Entity/PageContentTest.php index 8a78c8ac0..d433c8b88 100644 --- a/tests/Entity/PageContentTest.php +++ b/tests/Entity/PageContentTest.php @@ -1,15 +1,22 @@ -id)->first(); + $page = Page::query()->first(); + $secondPage = Page::query()->where('id', '!=', $page->id)->first(); $secondPage->html = "

Hello, This is a test

This is a second block of content

"; $secondPage->save(); @@ -37,8 +44,8 @@ class PageContentTest extends TestCase public function test_saving_page_with_includes() { - $page = Page::first(); - $secondPage = Page::where('id', '!=', $page->id)->first(); + $page = Page::query()->first(); + $secondPage = Page::query()->where('id', '!=', $page->id)->first(); $this->asEditor(); $includeTag = '{{@' . $secondPage->id . '}}'; @@ -55,8 +62,10 @@ class PageContentTest extends TestCase public function test_page_includes_do_not_break_tables() { - $page = Page::first(); - $secondPage = Page::where('id', '!=', $page->id)->first(); + /** @var Page $page */ + $page = Page::query()->first(); + /** @var Page $secondPage */ + $secondPage = Page::query()->where('id', '!=', $page->id)->first(); $content = '
test
'; $secondPage->html = $content; @@ -65,22 +74,58 @@ class PageContentTest extends TestCase $page->html = "{{@{$secondPage->id}#table}}"; $page->save(); + $pageResp = $this->asEditor()->get($page->getUrl()); + $pageResp->assertSee($content, false); + } + + public function test_page_includes_do_not_break_code() + { + /** @var Page $page */ + $page = Page::query()->first(); + /** @var Page $secondPage */ + $secondPage = Page::query()->where('id', '!=', $page->id)->first(); + + $content = '
var cat = null;
'; + $secondPage->html = $content; + $secondPage->save(); + + $page->html = "{{@{$secondPage->id}#bkmrk-code}}"; + $page->save(); + + $pageResp = $this->asEditor()->get($page->getUrl()); + $pageResp->assertSee($content, false); + } + + public function test_page_includes_rendered_on_book_export() + { + $page = Page::query()->first(); + $secondPage = Page::query() + ->where('book_id', '!=', $page->book_id) + ->first(); + + $content = '

my cat is awesome and scratchy

'; + $secondPage->html = $content; + $secondPage->save(); + + $page->html = "{{@{$secondPage->id}#bkmrk-meow}}"; + $page->save(); + $this->asEditor(); - $pageResp = $this->get($page->getUrl()); - $pageResp->assertSee($content); + $htmlContent = $this->get($page->book->getUrl('/export/html')); + $htmlContent->assertSee('my cat is awesome and scratchy'); } public function test_page_content_scripts_removed_by_default() { $this->asEditor(); - $page = Page::first(); + $page = Page::query()->first(); $script = 'abc123abc123'; $page->html = "escape {$script}"; $page->save(); $pageView = $this->get($page->getUrl()); $pageView->assertStatus(200); - $pageView->assertDontSee($script); + $pageView->assertDontSee($script, false); $pageView->assertSee('abc123abc123'); } @@ -96,7 +141,7 @@ class PageContentTest extends TestCase ]; $this->asEditor(); - $page = Page::first(); + $page = Page::query()->first(); foreach ($checks as $check) { $page->html = $check; @@ -104,24 +149,35 @@ class PageContentTest extends TestCase $pageView = $this->get($page->getUrl()); $pageView->assertStatus(200); - $pageView->assertElementNotContains('.page-content', ''); + $this->withHtml($pageView)->assertElementNotContains('.page-content', ''); } - } - public function test_iframe_js_and_base64_urls_are_removed() + public function test_js_and_base64_src_urls_are_removed() { $checks = [ '', + '', + '', '', '', + '', '', - '' + '', + '', + '', + '', + '', + '', + '', + '', + '', + '', ]; $this->asEditor(); - $page = Page::first(); + $page = Page::query()->first(); foreach ($checks as $check) { $page->html = $check; @@ -129,43 +185,120 @@ class PageContentTest extends TestCase $pageView = $this->get($page->getUrl()); $pageView->assertStatus(200); - $pageView->assertElementNotContains('.page-content', ''); - $pageView->assertElementNotContains('.page-content', 'src='); - $pageView->assertElementNotContains('.page-content', 'javascript:'); - $pageView->assertElementNotContains('.page-content', 'data:'); - $pageView->assertElementNotContains('.page-content', 'base64'); + $html = $this->withHtml($pageView); + $html->assertElementNotContains('.page-content', ''); + $html->assertElementNotContains('.page-content', 'src='); + $html->assertElementNotContains('.page-content', 'javascript:'); + $html->assertElementNotContains('.page-content', 'data:'); + $html->assertElementNotContains('.page-content', 'base64'); } + } + public function test_javascript_uri_links_are_removed() + { + $checks = [ + 'withHtml($pageView)->assertElementNotContains('.page-content', 'href=javascript:'); + } + } + + public function test_form_actions_with_javascript_are_removed() + { + $checks = [ + '
', + '
', + '
', + '
', + '
', + ]; + + $this->asEditor(); + $page = Page::query()->first(); + + foreach ($checks as $check) { + $page->html = $check; + $page->save(); + + $pageView = $this->get($page->getUrl()); + $pageView->assertStatus(200); + $this->withHtml($pageView)->assertElementNotContains('.page-content', '