BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

   1 <?php
   2
   3 namespace Tests\Entity;
   4
   5 use BookStack\Entities\Models\Page;
   6 use BookStack\Entities\Tools\PageContent;
   7 use Tests\TestCase;
   8 use Tests\Uploads\UsesImages;
   9
  10 class PageContentTest extends TestCase
  11 {
  12     use UsesImages;
  13
  14     protected $base64Jpeg = '/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=';
  15
  16     public function test_page_includes()
  17     {
  18         $page = Page::query()->first();
  19         $secondPage = Page::query()->where('id', '!=', $page->id)->first();
  20
  21         $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";
  22         $secondPage->save();
  23
  24         $this->asEditor();
  25
  26         $pageContent = $this->get($page->getUrl());
  27         $pageContent->assertDontSee('Hello, This is a test');
  28
  29         $originalHtml = $page->html;
  30         $page->html .= "{{@{$secondPage->id}}}";
  31         $page->save();
  32
  33         $pageContent = $this->get($page->getUrl());
  34         $pageContent->assertSee('Hello, This is a test');
  35         $pageContent->assertSee('This is a second block of content');
  36
  37         $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";
  38         $page->save();
  39
  40         $pageContent = $this->get($page->getUrl());
  41         $pageContent->assertDontSee('Hello, This is a test');
  42         $pageContent->assertSee('Well This is a second block of content');
  43     }
  44
  45     public function test_saving_page_with_includes()
  46     {
  47         $page = Page::query()->first();
  48         $secondPage = Page::query()->where('id', '!=', $page->id)->first();
  49
  50         $this->asEditor();
  51         $includeTag = '{{@' . $secondPage->id . '}}';
  52         $page->html = '<p>' . $includeTag . '</p>';
  53
  54         $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);
  55
  56         $resp->assertStatus(302);
  57
  58         $page = Page::find($page->id);
  59         $this->assertStringContainsString($includeTag, $page->html);
  60         $this->assertEquals('', $page->text);
  61     }
  62
  63     public function test_page_includes_do_not_break_tables()
  64     {
  65         $page = Page::query()->first();
  66         $secondPage = Page::query()->where('id', '!=', $page->id)->first();
  67
  68         $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';
  69         $secondPage->html = $content;
  70         $secondPage->save();
  71
  72         $page->html = "{{@{$secondPage->id}#table}}";
  73         $page->save();
  74
  75         $this->asEditor();
  76         $pageResp = $this->get($page->getUrl());
  77         $pageResp->assertSee($content, false);
  78     }
  79
  80     public function test_page_includes_rendered_on_book_export()
  81     {
  82         $page = Page::query()->first();
  83         $secondPage = Page::query()
  84             ->where('book_id', '!=', $page->book_id)
  85             ->first();
  86
  87         $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';
  88         $secondPage->html = $content;
  89         $secondPage->save();
  90
  91         $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";
  92         $page->save();
  93
  94         $this->asEditor();
  95         $htmlContent = $this->get($page->book->getUrl('/export/html'));
  96         $htmlContent->assertSee('my cat is awesome and scratchy');
  97     }
  98
  99     public function test_page_content_scripts_removed_by_default()
 100     {
 101         $this->asEditor();
 102         $page = Page::query()->first();
 103         $script = 'abc123<script>console.log("hello-test")</script>abc123';
 104         $page->html = "escape {$script}";
 105         $page->save();
 106
 107         $pageView = $this->get($page->getUrl());
 108         $pageView->assertStatus(200);
 109         $pageView->assertDontSee($script, false);
 110         $pageView->assertSee('abc123abc123');
 111     }
 112
 113     public function test_more_complex_content_script_escaping_scenarios()
 114     {
 115         $checks = [
 116             "<p>Some script</p><script>alert('cat')</script>",
 117             "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",
 118             "<p>Some script<script>alert('cat')</script></p>",
 119             "<p>Some script <div><script>alert('cat')</script></div></p>",
 120             "<p>Some script <script><div>alert('cat')</script></div></p>",
 121             "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",
 122         ];
 123
 124         $this->asEditor();
 125         $page = Page::query()->first();
 126
 127         foreach ($checks as $check) {
 128             $page->html = $check;
 129             $page->save();
 130
 131             $pageView = $this->get($page->getUrl());
 132             $pageView->assertStatus(200);
 133             $pageView->assertElementNotContains('.page-content', '<script>');
 134             $pageView->assertElementNotContains('.page-content', '</script>');
 135         }
 136     }
 137
 138     public function test_js_and_base64_src_urls_are_removed()
 139     {
 140         $checks = [
 141             '<iframe src="javascript:alert(document.cookie)"></iframe>',
 142             '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',
 143             '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',
 144             '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',
 145             '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
 146             '<iframe src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
 147             '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',
 148             '<img src="javascript:alert(document.cookie)"/>',
 149             '<img src="JavAScRipT:alert(document.cookie)"/>',
 150             '<img src="JavAScRipT:alert(document.cookie)"/>',
 151             '<img SRC=" javascript: alert(document.cookie)"/>',
 152             '<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',
 153             '<img src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',
 154             '<img src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',
 155             '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>',
 156             '<iframe SRCdoc="<script>window.alert(document.cookie)</script>"></iframe>',
 157             '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',
 158         ];
 159
 160         $this->asEditor();
 161         $page = Page::query()->first();
 162
 163         foreach ($checks as $check) {
 164             $page->html = $check;
 165             $page->save();
 166
 167             $pageView = $this->get($page->getUrl());
 168             $pageView->assertStatus(200);
 169             $pageView->assertElementNotContains('.page-content', '<iframe>');
 170             $pageView->assertElementNotContains('.page-content', '<img');
 171             $pageView->assertElementNotContains('.page-content', '</iframe>');
 172             $pageView->assertElementNotContains('.page-content', 'src=');
 173             $pageView->assertElementNotContains('.page-content', 'javascript:');
 174             $pageView->assertElementNotContains('.page-content', 'data:');
 175             $pageView->assertElementNotContains('.page-content', 'base64');
 176         }
 177     }
 178
 179     public function test_javascript_uri_links_are_removed()
 180     {
 181         $checks = [
 182             '<a id="xss" href="javascript:alert(document.cookie)>Click me</a>',
 183             '<a id="xss" href="javascript: alert(document.cookie)>Click me</a>',
 184             '<a id="xss" href="JaVaScRiPt: alert(document.cookie)>Click me</a>',
 185             '<a id="xss" href=" JaVaScRiPt: alert(document.cookie)>Click me</a>',
 186         ];
 187
 188         $this->asEditor();
 189         $page = Page::query()->first();
 190
 191         foreach ($checks as $check) {
 192             $page->html = $check;
 193             $page->save();
 194
 195             $pageView = $this->get($page->getUrl());
 196             $pageView->assertStatus(200);
 197             $pageView->assertElementNotContains('.page-content', '<a id="xss"');
 198             $pageView->assertElementNotContains('.page-content', 'href=javascript:');
 199         }
 200     }
 201
 202     public function test_form_actions_with_javascript_are_removed()
 203     {
 204         $checks = [
 205             '<form><input id="xss" type=submit formaction=javascript:alert(document.domain) value=Submit><input></form>',
 206             '<form ><button id="xss" formaction="JaVaScRiPt:alert(document.domain)">Click me</button></form>',
 207             '<form ><button id="xss" formaction=javascript:alert(document.domain)>Click me</button></form>',
 208             '<form id="xss" action=javascript:alert(document.domain)><input type=submit value=Submit></form>',
 209             '<form id="xss" action="JaVaScRiPt:alert(document.domain)"><input type=submit value=Submit></form>',
 210         ];
 211
 212         $this->asEditor();
 213         $page = Page::query()->first();
 214
 215         foreach ($checks as $check) {
 216             $page->html = $check;
 217             $page->save();
 218
 219             $pageView = $this->get($page->getUrl());
 220             $pageView->assertStatus(200);
 221             $pageView->assertElementNotContains('.page-content', '<button id="xss"');
 222             $pageView->assertElementNotContains('.page-content', '<input id="xss"');
 223             $pageView->assertElementNotContains('.page-content', '<form id="xss"');
 224             $pageView->assertElementNotContains('.page-content', 'action=javascript:');
 225             $pageView->assertElementNotContains('.page-content', 'formaction=javascript:');
 226         }
 227     }
 228
 229     public function test_metadata_redirects_are_removed()
 230     {
 231         $checks = [
 232             '<meta http-equiv="refresh" content="0; url=//external_url">',
 233             '<meta http-equiv="refresh" ConTeNt="0; url=//external_url">',
 234             '<meta http-equiv="refresh" content="0; UrL=//external_url">',
 235         ];
 236
 237         $this->asEditor();
 238         $page = Page::query()->first();
 239
 240         foreach ($checks as $check) {
 241             $page->html = $check;
 242             $page->save();
 243
 244             $pageView = $this->get($page->getUrl());
 245             $pageView->assertStatus(200);
 246             $pageView->assertElementNotContains('.page-content', '<meta>');
 247             $pageView->assertElementNotContains('.page-content', '</meta>');
 248             $pageView->assertElementNotContains('.page-content', 'content=');
 249             $pageView->assertElementNotContains('.page-content', 'external_url');
 250         }
 251     }
 252
 253     public function test_page_inline_on_attributes_removed_by_default()
 254     {
 255         $this->asEditor();
 256         $page = Page::query()->first();
 257         $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
 258         $page->html = "escape {$script}";
 259         $page->save();
 260
 261         $pageView = $this->get($page->getUrl());
 262         $pageView->assertStatus(200);
 263         $pageView->assertDontSee($script, false);
 264         $pageView->assertSee('<p>Hello</p>', false);
 265     }
 266
 267     public function test_more_complex_inline_on_attributes_escaping_scenarios()
 268     {
 269         $checks = [
 270             '<p onclick="console.log(\'test\')">Hello</p>',
 271             '<p OnCliCk="console.log(\'test\')">Hello</p>',
 272             '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',
 273             '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',
 274             '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',
 275             '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',
 276             '<a a="<img src=1 onerror=\'alert(1)\'> ',
 277             '\<a onclick="alert(document.cookie)"\>xss link\</a\>',
 278         ];
 279
 280         $this->asEditor();
 281         $page = Page::query()->first();
 282
 283         foreach ($checks as $check) {
 284             $page->html = $check;
 285             $page->save();
 286
 287             $pageView = $this->get($page->getUrl());
 288             $pageView->assertStatus(200);
 289             $pageView->assertElementNotContains('.page-content', 'onclick');
 290         }
 291     }
 292
 293     public function test_page_content_scripts_show_when_configured()
 294     {
 295         $this->asEditor();
 296         $page = Page::query()->first();
 297         config()->push('app.allow_content_scripts', 'true');
 298
 299         $script = 'abc123<script>console.log("hello-test")</script>abc123';
 300         $page->html = "no escape {$script}";
 301         $page->save();
 302
 303         $pageView = $this->get($page->getUrl());
 304         $pageView->assertSee($script, false);
 305         $pageView->assertDontSee('abc123abc123');
 306     }
 307
 308     public function test_svg_xlink_hrefs_are_removed()
 309     {
 310         $checks = [
 311             '<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',
 312             '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>',
 313         ];
 314
 315         $this->asEditor();
 316         $page = Page::query()->first();
 317
 318         foreach ($checks as $check) {
 319             $page->html = $check;
 320             $page->save();
 321
 322             $pageView = $this->get($page->getUrl());
 323             $pageView->assertStatus(200);
 324             $pageView->assertElementNotContains('.page-content', 'alert');
 325             $pageView->assertElementNotContains('.page-content', 'xlink:href');
 326             $pageView->assertElementNotContains('.page-content', 'application/xml');
 327         }
 328     }
 329
 330     public function test_page_inline_on_attributes_show_if_configured()
 331     {
 332         $this->asEditor();
 333         $page = Page::query()->first();
 334         config()->push('app.allow_content_scripts', 'true');
 335
 336         $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';
 337         $page->html = "escape {$script}";
 338         $page->save();
 339
 340         $pageView = $this->get($page->getUrl());
 341         $pageView->assertSee($script, false);
 342         $pageView->assertDontSee('<p>Hello</p>', false);
 343     }
 344
 345     public function test_duplicate_ids_does_not_break_page_render()
 346     {
 347         $this->asEditor();
 348         $pageA = Page::query()->first();
 349         $pageB = Page::query()->where('id', '!=', $pageA->id)->first();
 350
 351         $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';
 352         $pageA->html = $content;
 353         $pageA->save();
 354
 355         $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@' . $pageA->id . '#test}}</p>';
 356         $pageB->save();
 357
 358         $pageView = $this->get($pageB->getUrl());
 359         $pageView->assertSuccessful();
 360     }
 361
 362     public function test_duplicate_ids_fixed_on_page_save()
 363     {
 364         $this->asEditor();
 365         $page = Page::query()->first();
 366
 367         $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';
 368         $pageSave = $this->put($page->getUrl(), [
 369             'name'    => $page->name,
 370             'html'    => $content,
 371             'summary' => '',
 372         ]);
 373         $pageSave->assertRedirect();
 374
 375         $updatedPage = Page::query()->where('id', '=', $page->id)->first();
 376         $this->assertEquals(substr_count($updatedPage->html, 'bkmrk-test"'), 1);
 377     }
 378
 379     public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()
 380     {
 381         $this->asEditor();
 382         $page = Page::query()->first();
 383
 384         $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';
 385         $this->put($page->getUrl(), [
 386             'name'    => $page->name,
 387             'html'    => $content,
 388             'summary' => '',
 389         ]);
 390
 391         $updatedPage = Page::query()->where('id', '=', $page->id)->first();
 392         $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);
 393         $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);
 394     }
 395
 396     public function test_get_page_nav_sets_correct_properties()
 397     {
 398         $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';
 399         $pageContent = new PageContent(new Page(['html' => $content]));
 400         $navMap = $pageContent->getNavigation($content);
 401
 402         $this->assertCount(3, $navMap);
 403         $this->assertArrayMapIncludes([
 404             'nodeName' => 'h1',
 405             'link'     => '#testa',
 406             'text'     => 'Hello',
 407             'level'    => 1,
 408         ], $navMap[0]);
 409         $this->assertArrayMapIncludes([
 410             'nodeName' => 'h2',
 411             'link'     => '#testb',
 412             'text'     => 'There',
 413             'level'    => 2,
 414         ], $navMap[1]);
 415         $this->assertArrayMapIncludes([
 416             'nodeName' => 'h3',
 417             'link'     => '#testc',
 418             'text'     => 'Donkey',
 419             'level'    => 3,
 420         ], $navMap[2]);
 421     }
 422
 423     public function test_get_page_nav_does_not_show_empty_titles()
 424     {
 425         $content = '<h1 id="testa">Hello</h1><h2 id="testb">&nbsp;</h2><h3 id="testc"></h3>';
 426         $pageContent = new PageContent(new Page(['html' => $content]));
 427         $navMap = $pageContent->getNavigation($content);
 428
 429         $this->assertCount(1, $navMap);
 430         $this->assertArrayMapIncludes([
 431             'nodeName' => 'h1',
 432             'link'     => '#testa',
 433             'text'     => 'Hello',
 434         ], $navMap[0]);
 435     }
 436
 437     public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()
 438     {
 439         $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';
 440         $pageContent = new PageContent(new Page(['html' => $content]));
 441         $navMap = $pageContent->getNavigation($content);
 442
 443         $this->assertCount(3, $navMap);
 444         $this->assertArrayMapIncludes([
 445             'nodeName' => 'h4',
 446             'level'    => 1,
 447         ], $navMap[0]);
 448         $this->assertArrayMapIncludes([
 449             'nodeName' => 'h5',
 450             'level'    => 2,
 451         ], $navMap[1]);
 452         $this->assertArrayMapIncludes([
 453             'nodeName' => 'h6',
 454             'level'    => 3,
 455         ], $navMap[2]);
 456     }
 457
 458     public function test_page_text_decodes_html_entities()
 459     {
 460         $page = Page::query()->first();
 461
 462         $this->actingAs($this->getAdmin())
 463             ->put($page->getUrl(''), [
 464                 'name' => 'Testing',
 465                 'html' => '<p>&quot;Hello &amp; welcome&quot;</p>',
 466             ]);
 467
 468         $page->refresh();
 469         $this->assertEquals('"Hello & welcome"', $page->text);
 470     }
 471
 472     public function test_page_markdown_table_rendering()
 473     {
 474         $this->asEditor();
 475         $page = Page::query()->first();
 476
 477         $content = '| Syntax      | Description |
 478 | ----------- | ----------- |
 479 | Header      | Title       |
 480 | Paragraph   | Text        |';
 481         $this->put($page->getUrl(), [
 482             'name' => $page->name,  'markdown' => $content,
 483             'html' => '', 'summary' => '',
 484         ]);
 485
 486         $page->refresh();
 487         $this->assertStringContainsString('</tbody>', $page->html);
 488
 489         $pageView = $this->get($page->getUrl());
 490         $pageView->assertElementExists('.page-content table tbody td');
 491     }
 492
 493     public function test_page_markdown_task_list_rendering()
 494     {
 495         $this->asEditor();
 496         $page = Page::query()->first();
 497
 498         $content = '- [ ] Item a
 499 - [x] Item b';
 500         $this->put($page->getUrl(), [
 501             'name' => $page->name,  'markdown' => $content,
 502             'html' => '', 'summary' => '',
 503         ]);
 504
 505         $page->refresh();
 506         $this->assertStringContainsString('input', $page->html);
 507         $this->assertStringContainsString('type="checkbox"', $page->html);
 508
 509         $pageView = $this->get($page->getUrl());
 510         $pageView->assertElementExists('.page-content li.task-list-item input[type=checkbox]');
 511         $pageView->assertElementExists('.page-content li.task-list-item input[type=checkbox][checked=checked]');
 512     }
 513
 514     public function test_page_markdown_strikethrough_rendering()
 515     {
 516         $this->asEditor();
 517         $page = Page::query()->first();
 518
 519         $content = '~~some crossed out text~~';
 520         $this->put($page->getUrl(), [
 521             'name' => $page->name,  'markdown' => $content,
 522             'html' => '', 'summary' => '',
 523         ]);
 524
 525         $page->refresh();
 526         $this->assertStringMatchesFormat('%A<s%A>some crossed out text</s>%A', $page->html);
 527
 528         $pageView = $this->get($page->getUrl());
 529         $pageView->assertElementExists('.page-content p > s');
 530     }
 531
 532     public function test_page_markdown_single_html_comment_saving()
 533     {
 534         $this->asEditor();
 535         $page = Page::query()->first();
 536
 537         $content = '<!-- Test Comment -->';
 538         $this->put($page->getUrl(), [
 539             'name' => $page->name,  'markdown' => $content,
 540             'html' => '', 'summary' => '',
 541         ]);
 542
 543         $page->refresh();
 544         $this->assertStringMatchesFormat($content, $page->html);
 545
 546         $pageView = $this->get($page->getUrl());
 547         $pageView->assertStatus(200);
 548         $pageView->assertSee($content, false);
 549     }
 550
 551     public function test_base64_images_get_extracted_from_page_content()
 552     {
 553         $this->asEditor();
 554         $page = Page::query()->first();
 555
 556         $this->put($page->getUrl(), [
 557             'name' => $page->name, 'summary' => '',
 558             'html' => '<p>test<img src="data:image/jpeg;base64,' . $this->base64Jpeg . '"/></p>',
 559         ]);
 560
 561         $page->refresh();
 562         $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.jpeg">%A</p>%A', $page->html);
 563
 564         $matches = [];
 565         preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);
 566         $imagePath = $matches[1];
 567         $imageFile = public_path($imagePath);
 568         $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));
 569
 570         $this->deleteImage($imagePath);
 571     }
 572
 573     public function test_base64_images_get_extracted_when_containing_whitespace()
 574     {
 575         $this->asEditor();
 576         $page = Page::query()->first();
 577
 578         $base64PngWithWhitespace = "iVBORw0KGg\noAAAANSUhE\tUgAAAAEAAAA BCA   YAAAAfFcSJAAA\n\t ACklEQVR4nGMAAQAABQAB";
 579         $base64PngWithoutWhitespace = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQAB';
 580         $this->put($page->getUrl(), [
 581             'name' => $page->name, 'summary' => '',
 582             'html' => '<p>test<img src="data:image/png;base64,' . $base64PngWithWhitespace . '"/></p>',
 583         ]);
 584
 585         $page->refresh();
 586         $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.png">%A</p>%A', $page->html);
 587
 588         $matches = [];
 589         preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);
 590         $imagePath = $matches[1];
 591         $imageFile = public_path($imagePath);
 592         $this->assertEquals(base64_decode($base64PngWithoutWhitespace), file_get_contents($imageFile));
 593
 594         $this->deleteImage($imagePath);
 595     }
 596
 597     public function test_base64_images_within_html_blanked_if_not_supported_extension_for_extract()
 598     {
 599         // Relevant to https://github.com/BookStackApp/BookStack/issues/3010 and other cases
 600         $extensions = [
 601             'jiff', 'pngr', 'png ', ' png', '.png', 'png.', 'p.ng', ',png',
 602             'data:image/png', ',data:image/png',
 603         ];
 604
 605         foreach ($extensions as $extension) {
 606             $this->asEditor();
 607             $page = Page::query()->first();
 608
 609             $this->put($page->getUrl(), [
 610                 'name' => $page->name, 'summary' => '',
 611                 'html' => '<p>test<img src="data:image/' . $extension . ';base64,' . $this->base64Jpeg . '"/></p>',
 612             ]);
 613
 614             $page->refresh();
 615             $this->assertStringContainsString('<img src=""', $page->html);
 616         }
 617     }
 618
 619     public function test_base64_images_get_extracted_from_markdown_page_content()
 620     {
 621         $this->asEditor();
 622         $page = Page::query()->first();
 623
 624         $this->put($page->getUrl(), [
 625             'name'     => $page->name, 'summary' => '',
 626             'markdown' => 'test ![test](data:image/jpeg;base64,' . $this->base64Jpeg . ')',
 627         ]);
 628
 629         $page->refresh();
 630         $this->assertStringMatchesFormat('%A<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);
 631
 632         $matches = [];
 633         preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);
 634         $imagePath = $matches[1];
 635         $imageFile = public_path($imagePath);
 636         $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));
 637
 638         $this->deleteImage($imagePath);
 639     }
 640
 641     public function test_base64_images_within_markdown_blanked_if_not_supported_extension_for_extract()
 642     {
 643         $this->asEditor();
 644         $page = Page::query()->first();
 645
 646         $this->put($page->getUrl(), [
 647             'name'     => $page->name, 'summary' => '',
 648             'markdown' => 'test ![test](data:image/jiff;base64,' . $this->base64Jpeg . ')',
 649         ]);
 650
 651         $page->refresh();
 652         $this->assertStringContainsString('<img src=""', $page->html);
 653     }
 654 }