BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

   1 <?php namespace Tests;
   2
   3 use BookStack\Entities\Managers\PageContent;
   4 use BookStack\Entities\Page;
   5
   6 class PageContentTest extends TestCase
   7 {
   8
   9     public function test_page_includes()
  10     {
  11         $page = Page::first();
  12         $secondPage = Page::where('id', '!=', $page->id)->first();
  13
  14         $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";
  15         $secondPage->save();
  16
  17         $this->asEditor();
  18
  19         $pageContent = $this->get($page->getUrl());
  20         $pageContent->assertDontSee('Hello, This is a test');
  21
  22         $originalHtml = $page->html;
  23         $page->html .= "{{@{$secondPage->id}}}";
  24         $page->save();
  25
  26         $pageContent = $this->get($page->getUrl());
  27         $pageContent->assertSee('Hello, This is a test');
  28         $pageContent->assertSee('This is a second block of content');
  29
  30         $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";
  31         $page->save();
  32
  33         $pageContent = $this->get($page->getUrl());
  34         $pageContent->assertDontSee('Hello, This is a test');
  35         $pageContent->assertSee('Well This is a second block of content');
  36     }
  37
  38     public function test_saving_page_with_includes()
  39     {
  40         $page = Page::first();
  41         $secondPage = Page::where('id', '!=', $page->id)->first();
  42
  43         $this->asEditor();
  44         $includeTag = '{{@' . $secondPage->id . '}}';
  45         $page->html = '<p>' . $includeTag . '</p>';
  46
  47         $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);
  48
  49         $resp->assertStatus(302);
  50
  51         $page = Page::find($page->id);
  52         $this->assertStringContainsString($includeTag, $page->html);
  53         $this->assertEquals('', $page->text);
  54     }
  55
  56     public function test_page_includes_do_not_break_tables()
  57     {
  58         $page = Page::first();
  59         $secondPage = Page::where('id', '!=', $page->id)->first();
  60
  61         $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';
  62         $secondPage->html = $content;
  63         $secondPage->save();
  64
  65         $page->html = "{{@{$secondPage->id}#table}}";
  66         $page->save();
  67
  68         $this->asEditor();
  69         $pageResp = $this->get($page->getUrl());
  70         $pageResp->assertSee($content);
  71     }
  72
  73     public function test_page_content_scripts_removed_by_default()
  74     {
  75         $this->asEditor();
  76         $page = Page::first();
  77         $script = 'abc123<script>console.log("hello-test")</script>abc123';
  78         $page->html = "escape {$script}";
  79         $page->save();
  80
  81         $pageView = $this->get($page->getUrl());
  82         $pageView->assertStatus(200);
  83         $pageView->assertDontSee($script);
  84         $pageView->assertSee('abc123abc123');
  85     }
  86
  87     public function test_more_complex_content_script_escaping_scenarios()
  88     {
  89         $checks = [
  90             "<p>Some script</p><script>alert('cat')</script>",
  91             "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",
  92             "<p>Some script<script>alert('cat')</script></p>",
  93             "<p>Some script <div><script>alert('cat')</script></div></p>",
  94             "<p>Some script <script><div>alert('cat')</script></div></p>",
  95             "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",
  96         ];
  97
  98         $this->asEditor();
  99         $page = Page::first();
 100
 101         foreach ($checks as $check) {
 102             $page->html = $check;
 103             $page->save();
 104
 105             $pageView = $this->get($page->getUrl());
 106             $pageView->assertStatus(200);
 107             $pageView->assertElementNotContains('.page-content', '<script>');
 108             $pageView->assertElementNotContains('.page-content', '</script>');
 109         }
 110
 111     }
 112
 113     public function test_iframe_js_and_base64_urls_are_removed()
 114     {
 115         $checks = [
 116             '<iframe src="javascript:alert(document.cookie)"></iframe>',
 117             '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',
 118             '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
 119             '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
 120             '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>'
 121         ];
 122
 123         $this->asEditor();
 124         $page = Page::first();
 125
 126         foreach ($checks as $check) {
 127             $page->html = $check;
 128             $page->save();
 129
 130             $pageView = $this->get($page->getUrl());
 131             $pageView->assertStatus(200);
 132             $pageView->assertElementNotContains('.page-content', '<iframe>');
 133             $pageView->assertElementNotContains('.page-content', '</iframe>');
 134             $pageView->assertElementNotContains('.page-content', 'src=');
 135             $pageView->assertElementNotContains('.page-content', 'javascript:');
 136             $pageView->assertElementNotContains('.page-content', 'data:');
 137             $pageView->assertElementNotContains('.page-content', 'base64');
 138         }
 139
 140     }
 141
 142     public function test_page_inline_on_attributes_removed_by_default()
 143     {
 144         $this->asEditor();
 145         $page = Page::first();
 146         $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
 147         $page->html = "escape {$script}";
 148         $page->save();
 149
 150         $pageView = $this->get($page->getUrl());
 151         $pageView->assertStatus(200);
 152         $pageView->assertDontSee($script);
 153         $pageView->assertSee('<p>Hello</p>');
 154     }
 155
 156     public function test_more_complex_inline_on_attributes_escaping_scenarios()
 157     {
 158         $checks = [
 159             '<p onclick="console.log(\'test\')">Hello</p>',
 160             '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',
 161             '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',
 162             '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',
 163             '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',
 164             '<a a="<img src=1 onerror=\'alert(1)\'> ',
 165         ];
 166
 167         $this->asEditor();
 168         $page = Page::first();
 169
 170         foreach ($checks as $check) {
 171             $page->html = $check;
 172             $page->save();
 173
 174             $pageView = $this->get($page->getUrl());
 175             $pageView->assertStatus(200);
 176             $pageView->assertElementNotContains('.page-content', 'onclick');
 177         }
 178
 179     }
 180
 181     public function test_page_content_scripts_show_when_configured()
 182     {
 183         $this->asEditor();
 184         $page = Page::first();
 185         config()->push('app.allow_content_scripts', 'true');
 186
 187         $script = 'abc123<script>console.log("hello-test")</script>abc123';
 188         $page->html = "no escape {$script}";
 189         $page->save();
 190
 191         $pageView = $this->get($page->getUrl());
 192         $pageView->assertSee($script);
 193         $pageView->assertDontSee('abc123abc123');
 194     }
 195
 196     public function test_page_inline_on_attributes_show_if_configured()
 197     {
 198         $this->asEditor();
 199         $page = Page::first();
 200         config()->push('app.allow_content_scripts', 'true');
 201
 202         $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
 203         $page->html = "escape {$script}";
 204         $page->save();
 205
 206         $pageView = $this->get($page->getUrl());
 207         $pageView->assertSee($script);
 208         $pageView->assertDontSee('<p>Hello</p>');
 209     }
 210
 211     public function test_duplicate_ids_does_not_break_page_render()
 212     {
 213         $this->asEditor();
 214         $pageA = Page::first();
 215         $pageB = Page::query()->where('id', '!=', $pageA->id)->first();
 216
 217         $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';
 218         $pageA->html = $content;
 219         $pageA->save();
 220
 221         $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@'. $pageA->id .'#test}}</p>';
 222         $pageB->save();
 223
 224         $pageView = $this->get($pageB->getUrl());
 225         $pageView->assertSuccessful();
 226     }
 227
 228     public function test_duplicate_ids_fixed_on_page_save()
 229     {
 230         $this->asEditor();
 231         $page = Page::first();
 232
 233         $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';
 234         $pageSave = $this->put($page->getUrl(), [
 235             'name' => $page->name,
 236             'html' => $content,
 237             'summary' => ''
 238         ]);
 239         $pageSave->assertRedirect();
 240
 241         $updatedPage = Page::where('id', '=', $page->id)->first();
 242         $this->assertEquals(substr_count($updatedPage->html, "bkmrk-test\""), 1);
 243     }
 244
 245     public function test_get_page_nav_sets_correct_properties()
 246     {
 247         $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';
 248         $pageContent = new PageContent(new Page(['html' => $content]));
 249         $navMap = $pageContent->getNavigation($content);
 250
 251         $this->assertCount(3, $navMap);
 252         $this->assertArrayMapIncludes([
 253             'nodeName' => 'h1',
 254             'link' => '#testa',
 255             'text' => 'Hello',
 256             'level' => 1,
 257         ], $navMap[0]);
 258         $this->assertArrayMapIncludes([
 259             'nodeName' => 'h2',
 260             'link' => '#testb',
 261             'text' => 'There',
 262             'level' => 2,
 263         ], $navMap[1]);
 264         $this->assertArrayMapIncludes([
 265             'nodeName' => 'h3',
 266             'link' => '#testc',
 267             'text' => 'Donkey',
 268             'level' => 3,
 269         ], $navMap[2]);
 270     }
 271
 272     public function test_get_page_nav_does_not_show_empty_titles()
 273     {
 274         $content = '<h1 id="testa">Hello</h1><h2 id="testb">&nbsp;</h2><h3 id="testc"></h3>';
 275         $pageContent = new PageContent(new Page(['html' => $content]));
 276         $navMap = $pageContent->getNavigation($content);
 277
 278         $this->assertCount(1, $navMap);
 279         $this->assertArrayMapIncludes([
 280             'nodeName' => 'h1',
 281             'link' => '#testa',
 282             'text' => 'Hello'
 283         ], $navMap[0]);
 284     }
 285
 286     public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()
 287     {
 288         $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';
 289         $pageContent = new PageContent(new Page(['html' => $content]));
 290         $navMap = $pageContent->getNavigation($content);
 291
 292         $this->assertCount(3, $navMap);
 293         $this->assertArrayMapIncludes([
 294             'nodeName' => 'h4',
 295             'level' => 1,
 296         ], $navMap[0]);
 297         $this->assertArrayMapIncludes([
 298             'nodeName' => 'h5',
 299             'level' => 2,
 300         ], $navMap[1]);
 301         $this->assertArrayMapIncludes([
 302             'nodeName' => 'h6',
 303             'level' => 3,
 304         ], $navMap[2]);
 305     }
 306 }