]> BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php
Includes: Switched page to new system
[bookstack] / tests / Entity / PageContentTest.php
1 <?php
2
3 namespace Tests\Entity;
4
5 use BookStack\Entities\Models\Page;
6 use BookStack\Entities\Tools\PageContent;
7 use Tests\TestCase;
8
9 class PageContentTest extends TestCase
10 {
11     protected string $base64Jpeg = '/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=';
12
13     public function test_page_includes()
14     {
15         $page = $this->entities->page();
16         $secondPage = $this->entities->page();
17
18         $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";
19         $secondPage->save();
20
21         $this->asEditor();
22
23         $pageContent = $this->get($page->getUrl());
24         $pageContent->assertDontSee('Hello, This is a test');
25
26         $originalHtml = $page->html;
27         $page->html .= "{{@{$secondPage->id}}}";
28         $page->save();
29
30         $pageContent = $this->get($page->getUrl());
31         $pageContent->assertSee('Hello, This is a test');
32         $pageContent->assertSee('This is a second block of content');
33
34         $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";
35         $page->save();
36
37         $pageContent = $this->get($page->getUrl());
38         $pageContent->assertDontSee('Hello, This is a test');
39         $pageContent->assertSee('Well This is a second block of content');
40     }
41
42     public function test_saving_page_with_includes()
43     {
44         $page = $this->entities->page();
45         $secondPage = $this->entities->page();
46
47         $this->asEditor();
48         $includeTag = '{{@' . $secondPage->id . '}}';
49         $page->html = '<p>' . $includeTag . '</p>';
50
51         $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);
52
53         $resp->assertStatus(302);
54
55         $page = Page::find($page->id);
56         $this->assertStringContainsString($includeTag, $page->html);
57         $this->assertEquals('', $page->text);
58     }
59
60     public function test_page_includes_rendered_on_book_export()
61     {
62         $page = $this->entities->page();
63         $secondPage = Page::query()
64             ->where('book_id', '!=', $page->book_id)
65             ->first();
66
67         $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';
68         $secondPage->html = $content;
69         $secondPage->save();
70
71         $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";
72         $page->save();
73
74         $this->asEditor();
75         $htmlContent = $this->get($page->book->getUrl('/export/html'));
76         $htmlContent->assertSee('my cat is awesome and scratchy');
77     }
78
79     public function test_page_includes_can_be_nested_up_to_three_times()
80     {
81         $page = $this->entities->page();
82         $tag = "{{@{$page->id}#bkmrk-test}}";
83         $page->html = '<p id="bkmrk-test">Hello Barry ' . $tag . '</p>';
84         $page->save();
85
86         $pageResp = $this->asEditor()->get($page->getUrl());
87         $this->withHtml($pageResp)->assertElementContains('#bkmrk-test', 'Hello Barry Hello Barry Hello Barry Hello Barry ' . $tag);
88         $this->withHtml($pageResp)->assertElementNotContains('#bkmrk-test', 'Hello Barry Hello Barry Hello Barry Hello Barry Hello Barry ' . $tag);
89     }
90
91     public function test_page_content_scripts_removed_by_default()
92     {
93         $this->asEditor();
94         $page = $this->entities->page();
95         $script = 'abc123<script>console.log("hello-test")</script>abc123';
96         $page->html = "escape {$script}";
97         $page->save();
98
99         $pageView = $this->get($page->getUrl());
100         $pageView->assertStatus(200);
101         $pageView->assertDontSee($script, false);
102         $pageView->assertSee('abc123abc123');
103     }
104
105     public function test_more_complex_content_script_escaping_scenarios()
106     {
107         $checks = [
108             "<p>Some script</p><script>alert('cat')</script>",
109             "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",
110             "<p>Some script<script>alert('cat')</script></p>",
111             "<p>Some script <div><script>alert('cat')</script></div></p>",
112             "<p>Some script <script><div>alert('cat')</script></div></p>",
113             "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",
114         ];
115
116         $this->asEditor();
117         $page = $this->entities->page();
118
119         foreach ($checks as $check) {
120             $page->html = $check;
121             $page->save();
122
123             $pageView = $this->get($page->getUrl());
124             $pageView->assertStatus(200);
125             $this->withHtml($pageView)->assertElementNotContains('.page-content', '<script>');
126             $this->withHtml($pageView)->assertElementNotContains('.page-content', '</script>');
127         }
128     }
129
130     public function test_js_and_base64_src_urls_are_removed()
131     {
132         $checks = [
133             '<iframe src="javascript:alert(document.cookie)"></iframe>',
134             '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',
135             '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',
136             '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',
137             '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
138             '<iframe src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
139             '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
140             '<img src="javascript:alert(document.cookie)"/>',
141             '<img src="JavAScRipT:alert(document.cookie)"/>',
142             '<img src="JavAScRipT:alert(document.cookie)"/>',
143             '<img SRC=" javascript: alert(document.cookie)"/>',
144             '<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',
145             '<img src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',
146             '<img src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',
147             '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>',
148             '<iframe SRCdoc="<script>window.alert(document.cookie)</script>"></iframe>',
149             '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',
150         ];
151
152         $this->asEditor();
153         $page = $this->entities->page();
154
155         foreach ($checks as $check) {
156             $page->html = $check;
157             $page->save();
158
159             $pageView = $this->get($page->getUrl());
160             $pageView->assertStatus(200);
161             $html = $this->withHtml($pageView);
162             $html->assertElementNotContains('.page-content', '<iframe>');
163             $html->assertElementNotContains('.page-content', '<img');
164             $html->assertElementNotContains('.page-content', '</iframe>');
165             $html->assertElementNotContains('.page-content', 'src=');
166             $html->assertElementNotContains('.page-content', 'javascript:');
167             $html->assertElementNotContains('.page-content', 'data:');
168             $html->assertElementNotContains('.page-content', 'base64');
169         }
170     }
171
172     public function test_javascript_uri_links_are_removed()
173     {
174         $checks = [
175             '<a id="xss" href="javascript:alert(document.cookie)>Click me</a>',
176             '<a id="xss" href="javascript: alert(document.cookie)>Click me</a>',
177             '<a id="xss" href="JaVaScRiPt: alert(document.cookie)>Click me</a>',
178             '<a id="xss" href=" JaVaScRiPt: alert(document.cookie)>Click me</a>',
179         ];
180
181         $this->asEditor();
182         $page = $this->entities->page();
183
184         foreach ($checks as $check) {
185             $page->html = $check;
186             $page->save();
187
188             $pageView = $this->get($page->getUrl());
189             $pageView->assertStatus(200);
190             $this->withHtml($pageView)->assertElementNotContains('.page-content', '<a id="xss"');
191             $this->withHtml($pageView)->assertElementNotContains('.page-content', 'href=javascript:');
192         }
193     }
194
195     public function test_form_actions_with_javascript_are_removed()
196     {
197         $checks = [
198             '<form><input id="xss" type=submit formaction=javascript:alert(document.domain) value=Submit><input></form>',
199             '<form ><button id="xss" formaction="JaVaScRiPt:alert(document.domain)">Click me</button></form>',
200             '<form ><button id="xss" formaction=javascript:alert(document.domain)>Click me</button></form>',
201             '<form id="xss" action=javascript:alert(document.domain)><input type=submit value=Submit></form>',
202             '<form id="xss" action="JaVaScRiPt:alert(document.domain)"><input type=submit value=Submit></form>',
203         ];
204
205         $this->asEditor();
206         $page = $this->entities->page();
207
208         foreach ($checks as $check) {
209             $page->html = $check;
210             $page->save();
211
212             $pageView = $this->get($page->getUrl());
213             $pageView->assertStatus(200);
214             $this->withHtml($pageView)->assertElementNotContains('.page-content', '<button id="xss"');
215             $this->withHtml($pageView)->assertElementNotContains('.page-content', '<input id="xss"');
216             $this->withHtml($pageView)->assertElementNotContains('.page-content', '<form id="xss"');
217             $this->withHtml($pageView)->assertElementNotContains('.page-content', 'action=javascript:');
218             $this->withHtml($pageView)->assertElementNotContains('.page-content', 'formaction=javascript:');
219         }
220     }
221
222     public function test_metadata_redirects_are_removed()
223     {
224         $checks = [
225             '<meta http-equiv="refresh" content="0; url=//external_url">',
226             '<meta http-equiv="refresh" ConTeNt="0; url=//external_url">',
227             '<meta http-equiv="refresh" content="0; UrL=//external_url">',
228         ];
229
230         $this->asEditor();
231         $page = $this->entities->page();
232
233         foreach ($checks as $check) {
234             $page->html = $check;
235             $page->save();
236
237             $pageView = $this->get($page->getUrl());
238             $pageView->assertStatus(200);
239             $this->withHtml($pageView)->assertElementNotContains('.page-content', '<meta>');
240             $this->withHtml($pageView)->assertElementNotContains('.page-content', '</meta>');
241             $this->withHtml($pageView)->assertElementNotContains('.page-content', 'content=');
242             $this->withHtml($pageView)->assertElementNotContains('.page-content', 'external_url');
243         }
244     }
245
246     public function test_page_inline_on_attributes_removed_by_default()
247     {
248         $this->asEditor();
249         $page = $this->entities->page();
250         $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
251         $page->html = "escape {$script}";
252         $page->save();
253
254         $pageView = $this->get($page->getUrl());
255         $pageView->assertStatus(200);
256         $pageView->assertDontSee($script, false);
257         $pageView->assertSee('<p>Hello</p>', false);
258     }
259
260     public function test_more_complex_inline_on_attributes_escaping_scenarios()
261     {
262         $checks = [
263             '<p onclick="console.log(\'test\')">Hello</p>',
264             '<p OnCliCk="console.log(\'test\')">Hello</p>',
265             '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',
266             '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',
267             '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',
268             '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',
269             '<a a="<img src=1 onerror=\'alert(1)\'> ',
270             '\<a onclick="alert(document.cookie)"\>xss link\</a\>',
271         ];
272
273         $this->asEditor();
274         $page = $this->entities->page();
275
276         foreach ($checks as $check) {
277             $page->html = $check;
278             $page->save();
279
280             $pageView = $this->get($page->getUrl());
281             $pageView->assertStatus(200);
282             $this->withHtml($pageView)->assertElementNotContains('.page-content', 'onclick');
283         }
284     }
285
286     public function test_page_content_scripts_show_when_configured()
287     {
288         $this->asEditor();
289         $page = $this->entities->page();
290         config()->set('app.allow_content_scripts', 'true');
291
292         $script = 'abc123<script>console.log("hello-test")</script>abc123';
293         $page->html = "no escape {$script}";
294         $page->save();
295
296         $pageView = $this->get($page->getUrl());
297         $pageView->assertSee($script, false);
298         $pageView->assertDontSee('abc123abc123');
299     }
300
301     public function test_svg_script_usage_is_removed()
302     {
303         $checks = [
304             '<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',
305             '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>',
306             '<svg><animate href=#xss attributeName=href values=javascript:alert(1) /></svg>',
307             '<svg><animate href="#xss" attributeName="href" values="a;javascript:alert(1)" /></svg>',
308             '<svg><animate href="#xss" attributeName="href" values="a;data:alert(1)" /></svg>',
309             '<svg><animate href=#xss attributeName=href from=javascript:alert(1) to=1 /><a id=xss><text x=20 y=20>XSS</text></a>',
310             '<svg><set href=#xss attributeName=href from=? to=javascript:alert(1) /><a id=xss><text x=20 y=20>XSS</text></a>',
311             '<svg><g><g><g><animate href=#xss attributeName=href values=javascript:alert(1) /></g></g></g></svg>',
312         ];
313
314         $this->asEditor();
315         $page = $this->entities->page();
316
317         foreach ($checks as $check) {
318             $page->html = $check;
319             $page->save();
320
321             $pageView = $this->get($page->getUrl());
322             $pageView->assertStatus(200);
323             $html = $this->withHtml($pageView);
324             $html->assertElementNotContains('.page-content', 'alert');
325             $html->assertElementNotContains('.page-content', 'xlink:href');
326             $html->assertElementNotContains('.page-content', 'application/xml');
327             $html->assertElementNotContains('.page-content', 'javascript');
328         }
329     }
330
331     public function test_page_inline_on_attributes_show_if_configured()
332     {
333         $this->asEditor();
334         $page = $this->entities->page();
335         config()->set('app.allow_content_scripts', 'true');
336
337         $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
338         $page->html = "escape {$script}";
339         $page->save();
340
341         $pageView = $this->get($page->getUrl());
342         $pageView->assertSee($script, false);
343         $pageView->assertDontSee('<p>Hello</p>', false);
344     }
345
346     public function test_duplicate_ids_does_not_break_page_render()
347     {
348         $this->asEditor();
349         $pageA = Page::query()->first();
350         $pageB = Page::query()->where('id', '!=', $pageA->id)->first();
351
352         $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';
353         $pageA->html = $content;
354         $pageA->save();
355
356         $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@' . $pageA->id . '#test}}</p>';
357         $pageB->save();
358
359         $pageView = $this->get($pageB->getUrl());
360         $pageView->assertSuccessful();
361     }
362
363     public function test_duplicate_ids_fixed_on_page_save()
364     {
365         $this->asEditor();
366         $page = $this->entities->page();
367
368         $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';
369         $pageSave = $this->put($page->getUrl(), [
370             'name'    => $page->name,
371             'html'    => $content,
372             'summary' => '',
373         ]);
374         $pageSave->assertRedirect();
375
376         $updatedPage = Page::query()->where('id', '=', $page->id)->first();
377         $this->assertEquals(substr_count($updatedPage->html, 'bkmrk-test"'), 1);
378     }
379
380     public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()
381     {
382         $this->asEditor();
383         $page = $this->entities->page();
384
385         $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';
386         $this->put($page->getUrl(), [
387             'name'    => $page->name,
388             'html'    => $content,
389             'summary' => '',
390         ]);
391
392         $updatedPage = Page::query()->where('id', '=', $page->id)->first();
393         $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);
394         $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);
395     }
396
397     public function test_get_page_nav_sets_correct_properties()
398     {
399         $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';
400         $pageContent = new PageContent(new Page(['html' => $content]));
401         $navMap = $pageContent->getNavigation($content);
402
403         $this->assertCount(3, $navMap);
404         $this->assertArrayMapIncludes([
405             'nodeName' => 'h1',
406             'link'     => '#testa',
407             'text'     => 'Hello',
408             'level'    => 1,
409         ], $navMap[0]);
410         $this->assertArrayMapIncludes([
411             'nodeName' => 'h2',
412             'link'     => '#testb',
413             'text'     => 'There',
414             'level'    => 2,
415         ], $navMap[1]);
416         $this->assertArrayMapIncludes([
417             'nodeName' => 'h3',
418             'link'     => '#testc',
419             'text'     => 'Donkey',
420             'level'    => 3,
421         ], $navMap[2]);
422     }
423
424     public function test_get_page_nav_does_not_show_empty_titles()
425     {
426         $content = '<h1 id="testa">Hello</h1><h2 id="testb">&nbsp;</h2><h3 id="testc"></h3>';
427         $pageContent = new PageContent(new Page(['html' => $content]));
428         $navMap = $pageContent->getNavigation($content);
429
430         $this->assertCount(1, $navMap);
431         $this->assertArrayMapIncludes([
432             'nodeName' => 'h1',
433             'link'     => '#testa',
434             'text'     => 'Hello',
435         ], $navMap[0]);
436     }
437
438     public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()
439     {
440         $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';
441         $pageContent = new PageContent(new Page(['html' => $content]));
442         $navMap = $pageContent->getNavigation($content);
443
444         $this->assertCount(3, $navMap);
445         $this->assertArrayMapIncludes([
446             'nodeName' => 'h4',
447             'level'    => 1,
448         ], $navMap[0]);
449         $this->assertArrayMapIncludes([
450             'nodeName' => 'h5',
451             'level'    => 2,
452         ], $navMap[1]);
453         $this->assertArrayMapIncludes([
454             'nodeName' => 'h6',
455             'level'    => 3,
456         ], $navMap[2]);
457     }
458
459     public function test_page_text_decodes_html_entities()
460     {
461         $page = $this->entities->page();
462
463         $this->actingAs($this->users->admin())
464             ->put($page->getUrl(''), [
465                 'name' => 'Testing',
466                 'html' => '<p>&quot;Hello &amp; welcome&quot;</p>',
467             ]);
468
469         $page->refresh();
470         $this->assertEquals('"Hello & welcome"', $page->text);
471     }
472
473     public function test_page_markdown_table_rendering()
474     {
475         $this->asEditor();
476         $page = $this->entities->page();
477
478         $content = '| Syntax      | Description |
479 | ----------- | ----------- |
480 | Header      | Title       |
481 | Paragraph   | Text        |';
482         $this->put($page->getUrl(), [
483             'name' => $page->name,  'markdown' => $content,
484             'html' => '', 'summary' => '',
485         ]);
486
487         $page->refresh();
488         $this->assertStringContainsString('</tbody>', $page->html);
489
490         $pageView = $this->get($page->getUrl());
491         $this->withHtml($pageView)->assertElementExists('.page-content table tbody td');
492     }
493
494     public function test_page_markdown_task_list_rendering()
495     {
496         $this->asEditor();
497         $page = $this->entities->page();
498
499         $content = '- [ ] Item a
500 - [x] Item b';
501         $this->put($page->getUrl(), [
502             'name' => $page->name,  'markdown' => $content,
503             'html' => '', 'summary' => '',
504         ]);
505
506         $page->refresh();
507         $this->assertStringContainsString('input', $page->html);
508         $this->assertStringContainsString('type="checkbox"', $page->html);
509
510         $pageView = $this->get($page->getUrl());
511         $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox]');
512         $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox][checked]');
513     }
514
515     public function test_page_markdown_strikethrough_rendering()
516     {
517         $this->asEditor();
518         $page = $this->entities->page();
519
520         $content = '~~some crossed out text~~';
521         $this->put($page->getUrl(), [
522             'name' => $page->name,  'markdown' => $content,
523             'html' => '', 'summary' => '',
524         ]);
525
526         $page->refresh();
527         $this->assertStringMatchesFormat('%A<s%A>some crossed out text</s>%A', $page->html);
528
529         $pageView = $this->get($page->getUrl());
530         $this->withHtml($pageView)->assertElementExists('.page-content p > s');
531     }
532
533     public function test_page_markdown_single_html_comment_saving()
534     {
535         $this->asEditor();
536         $page = $this->entities->page();
537
538         $content = '<!-- Test Comment -->';
539         $this->put($page->getUrl(), [
540             'name' => $page->name,  'markdown' => $content,
541             'html' => '', 'summary' => '',
542         ]);
543
544         $page->refresh();
545         $this->assertStringMatchesFormat($content, $page->html);
546
547         $pageView = $this->get($page->getUrl());
548         $pageView->assertStatus(200);
549         $pageView->assertSee($content, false);
550     }
551
552     public function test_base64_images_get_extracted_from_page_content()
553     {
554         $this->asEditor();
555         $page = $this->entities->page();
556
557         $this->put($page->getUrl(), [
558             'name' => $page->name, 'summary' => '',
559             'html' => '<p>test<img src="data:image/jpeg;base64,' . $this->base64Jpeg . '"/></p>',
560         ]);
561
562         $page->refresh();
563         $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.jpeg">%A</p>%A', $page->html);
564
565         $matches = [];
566         preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);
567         $imagePath = $matches[1];
568         $imageFile = public_path($imagePath);
569         $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));
570
571         $this->files->deleteAtRelativePath($imagePath);
572     }
573
574     public function test_base64_images_get_extracted_when_containing_whitespace()
575     {
576         $this->asEditor();
577         $page = $this->entities->page();
578
579         $base64PngWithWhitespace = "iVBORw0KGg\noAAAANSUhE\tUgAAAAEAAAA BCA   YAAAAfFcSJAAA\n\t ACklEQVR4nGMAAQAABQAB";
580         $base64PngWithoutWhitespace = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQAB';
581         $this->put($page->getUrl(), [
582             'name' => $page->name, 'summary' => '',
583             'html' => '<p>test<img src="data:image/png;base64,' . $base64PngWithWhitespace . '"/></p>',
584         ]);
585
586         $page->refresh();
587         $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.png">%A</p>%A', $page->html);
588
589         $matches = [];
590         preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);
591         $imagePath = $matches[1];
592         $imageFile = public_path($imagePath);
593         $this->assertEquals(base64_decode($base64PngWithoutWhitespace), file_get_contents($imageFile));
594
595         $this->files->deleteAtRelativePath($imagePath);
596     }
597
598     public function test_base64_images_within_html_blanked_if_not_supported_extension_for_extract()
599     {
600         // Relevant to https://github.com/BookStackApp/BookStack/issues/3010 and other cases
601         $extensions = [
602             'jiff', 'pngr', 'png ', ' png', '.png', 'png.', 'p.ng', ',png',
603             'data:image/png', ',data:image/png',
604         ];
605
606         foreach ($extensions as $extension) {
607             $this->asEditor();
608             $page = $this->entities->page();
609
610             $this->put($page->getUrl(), [
611                 'name' => $page->name, 'summary' => '',
612                 'html' => '<p>test<img src="data:image/' . $extension . ';base64,' . $this->base64Jpeg . '"/></p>',
613             ]);
614
615             $page->refresh();
616             $this->assertStringContainsString('<img src=""', $page->html);
617         }
618     }
619
620     public function test_base64_images_get_extracted_from_markdown_page_content()
621     {
622         $this->asEditor();
623         $page = $this->entities->page();
624
625         $this->put($page->getUrl(), [
626             'name'     => $page->name, 'summary' => '',
627             'markdown' => 'test ![test](data:image/jpeg;base64,' . $this->base64Jpeg . ')',
628         ]);
629
630         $page->refresh();
631         $this->assertStringMatchesFormat('%A<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);
632
633         $matches = [];
634         preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);
635         $imagePath = $matches[1];
636         $imageFile = public_path($imagePath);
637         $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));
638
639         $this->files->deleteAtRelativePath($imagePath);
640     }
641
642     public function test_markdown_base64_extract_not_limited_by_pcre_limits()
643     {
644         $pcreBacktrackLimit = ini_get('pcre.backtrack_limit');
645         $pcreRecursionLimit = ini_get('pcre.recursion_limit');
646
647         $this->asEditor();
648         $page = $this->entities->page();
649
650         ini_set('pcre.backtrack_limit', '500');
651         ini_set('pcre.recursion_limit', '500');
652
653         $content = str_repeat('a', 5000);
654         $base64Content = base64_encode($content);
655
656         $this->put($page->getUrl(), [
657             'name'     => $page->name, 'summary' => '',
658             'markdown' => 'test ![test](data:image/jpeg;base64,' . $base64Content . ') ![test](data:image/jpeg;base64,' . $base64Content . ')',
659         ]);
660
661         $page->refresh();
662         $this->assertStringMatchesFormat('<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test"> <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);
663
664         $matches = [];
665         preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);
666         $imagePath = $matches[1];
667         $imageFile = public_path($imagePath);
668         $this->assertEquals($content, file_get_contents($imageFile));
669
670         $this->files->deleteAtRelativePath($imagePath);
671         ini_set('pcre.backtrack_limit', $pcreBacktrackLimit);
672         ini_set('pcre.recursion_limit', $pcreRecursionLimit);
673     }
674
675     public function test_base64_images_within_markdown_blanked_if_not_supported_extension_for_extract()
676     {
677         $page = $this->entities->page();
678
679         $this->asEditor()->put($page->getUrl(), [
680             'name'     => $page->name, 'summary' => '',
681             'markdown' => 'test ![test](data:image/jiff;base64,' . $this->base64Jpeg . ')',
682         ]);
683
684         $this->assertStringContainsString('<img src=""', $page->refresh()->html);
685     }
686
687     public function test_nested_headers_gets_assigned_an_id()
688     {
689         $page = $this->entities->page();
690
691         $content = '<table><tbody><tr><td><h5>Simple Test</h5></td></tr></tbody></table>';
692         $this->asEditor()->put($page->getUrl(), [
693             'name'    => $page->name,
694             'html'    => $content,
695         ]);
696
697         // The top level <table> node will get assign the bkmrk-simple-test id because the system will
698         // take the node value of h5
699         // So the h5 should get the bkmrk-simple-test-1 id
700         $this->assertStringContainsString('<h5 id="bkmrk-simple-test-1">Simple Test</h5>', $page->refresh()->html);
701     }
702
703     public function test_non_breaking_spaces_are_preserved()
704     {
705         $page = $this->entities->page();
706
707         $content = '<p>&nbsp;</p>';
708         $this->asEditor()->put($page->getUrl(), [
709             'name'    => $page->name,
710             'html'    => $content,
711         ]);
712
713         $this->assertStringContainsString('<p id="bkmrk-%C2%A0">&nbsp;</p>', $page->refresh()->html);
714     }
715
716     public function test_page_save_with_many_headers_and_links_is_reasonable()
717     {
718         $page = $this->entities->page();
719
720         $content = '';
721         for ($i = 0; $i < 500; $i++) {
722             $content .= "<table><tbody><tr><td><h5 id='header-{$i}'>Simple Test</h5><a href='#header-{$i}'></a></td></tr></tbody></table>";
723         }
724
725         $time = time();
726         $this->asEditor()->put($page->getUrl(), [
727             'name'    => $page->name,
728             'html'    => $content,
729         ])->assertRedirect();
730
731         $timeElapsed = time() - $time;
732         $this->assertLessThan(3, $timeElapsed);
733     }
734 }