BookStack Code Mirror - bookstack/blob - tests/Exports/HtmlExportTest.php

   1 <?php
   2
   3 namespace Tests\Exports;
   4
   5 use BookStack\Entities\Models\Book;
   6 use BookStack\Entities\Models\Chapter;
   7 use BookStack\Entities\Models\Page;
   8 use Illuminate\Support\Facades\Storage;
   9 use Tests\TestCase;
  10
  11 class HtmlExportTest extends TestCase
  12 {
  13     public function test_page_html_export()
  14     {
  15         $page = $this->entities->page();
  16         $this->asEditor();
  17
  18         $resp = $this->get($page->getUrl('/export/html'));
  19         $resp->assertStatus(200);
  20         $resp->assertSee($page->name);
  21         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.html"');
  22     }
  23
  24     public function test_book_html_export()
  25     {
  26         $page = $this->entities->page();
  27         $book = $page->book;
  28         $this->asEditor();
  29
  30         $resp = $this->get($book->getUrl('/export/html'));
  31         $resp->assertStatus(200);
  32         $resp->assertSee($book->name);
  33         $resp->assertSee($page->name);
  34         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.html"');
  35     }
  36
  37     public function test_book_html_export_shows_html_descriptions()
  38     {
  39         $book = $this->entities->bookHasChaptersAndPages();
  40         $chapter = $book->chapters()->first();
  41         $book->description_html = '<p>A description with <strong>HTML</strong> within!</p>';
  42         $chapter->description_html = '<p>A chapter description with <strong>HTML</strong> within!</p>';
  43         $book->save();
  44         $chapter->save();
  45
  46         $resp = $this->asEditor()->get($book->getUrl('/export/html'));
  47         $resp->assertSee($book->description_html, false);
  48         $resp->assertSee($chapter->description_html, false);
  49     }
  50
  51     public function test_chapter_html_export()
  52     {
  53         $chapter = $this->entities->chapter();
  54         $page = $chapter->pages[0];
  55         $this->asEditor();
  56
  57         $resp = $this->get($chapter->getUrl('/export/html'));
  58         $resp->assertStatus(200);
  59         $resp->assertSee($chapter->name);
  60         $resp->assertSee($page->name);
  61         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.html"');
  62     }
  63
  64     public function test_chapter_html_export_shows_html_descriptions()
  65     {
  66         $chapter = $this->entities->chapter();
  67         $chapter->description_html = '<p>A description with <strong>HTML</strong> within!</p>';
  68         $chapter->save();
  69
  70         $resp = $this->asEditor()->get($chapter->getUrl('/export/html'));
  71         $resp->assertSee($chapter->description_html, false);
  72     }
  73
  74     public function test_page_html_export_contains_custom_head_if_set()
  75     {
  76         $page = $this->entities->page();
  77
  78         $customHeadContent = '<style>p{color: red;}</style>';
  79         $this->setSettings(['app-custom-head' => $customHeadContent]);
  80
  81         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
  82         $resp->assertSee($customHeadContent, false);
  83     }
  84
  85     public function test_page_html_export_does_not_break_with_only_comments_in_custom_head()
  86     {
  87         $page = $this->entities->page();
  88
  89         $customHeadContent = '<!-- A comment -->';
  90         $this->setSettings(['app-custom-head' => $customHeadContent]);
  91
  92         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
  93         $resp->assertStatus(200);
  94         $resp->assertSee($customHeadContent, false);
  95     }
  96
  97     public function test_page_html_export_use_absolute_dates()
  98     {
  99         $page = $this->entities->page();
 100
 101         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 102         $resp->assertSee($page->created_at->isoFormat('D MMMM Y HH:mm:ss'));
 103         $resp->assertDontSee($page->created_at->diffForHumans());
 104         $resp->assertSee($page->updated_at->isoFormat('D MMMM Y HH:mm:ss'));
 105         $resp->assertDontSee($page->updated_at->diffForHumans());
 106     }
 107
 108     public function test_page_export_does_not_include_user_or_revision_links()
 109     {
 110         $page = $this->entities->page();
 111
 112         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 113         $resp->assertDontSee($page->getUrl('/revisions'));
 114         $resp->assertDontSee($page->createdBy->getProfileUrl());
 115         $resp->assertSee($page->createdBy->name);
 116     }
 117
 118     public function test_page_export_sets_right_data_type_for_svg_embeds()
 119     {
 120         $page = $this->entities->page();
 121         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 122         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 123         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg">';
 124         $page->save();
 125
 126         $this->asEditor();
 127         $resp = $this->get($page->getUrl('/export/html'));
 128         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 129
 130         $resp->assertStatus(200);
 131         $resp->assertSee('<img src="data:image/svg+xml;base64', false);
 132     }
 133
 134     public function test_page_image_containment_works_on_multiple_images_within_a_single_line()
 135     {
 136         $page = $this->entities->page();
 137         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 138         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 139         Storage::disk('local')->put('uploads/images/gallery/svg_test2.svg', '<svg></svg>');
 140         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg" class="a"><img src="http://localhost/uploads/images/gallery/svg_test2.svg" class="b">';
 141         $page->save();
 142
 143         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 144         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 145         Storage::disk('local')->delete('uploads/images/gallery/svg_test2.svg');
 146
 147         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test');
 148     }
 149
 150     public function test_page_export_contained_html_image_fetches_only_run_when_url_points_to_image_upload_folder()
 151     {
 152         $page = $this->entities->page();
 153         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg"/>'
 154             . '<img src="http://localhost/uploads/svg_test.svg"/>'
 155             . '<img src="/uploads/svg_test.svg"/>';
 156         $storageDisk = Storage::disk('local');
 157         $storageDisk->makeDirectory('uploads/images/gallery');
 158         $storageDisk->put('uploads/images/gallery/svg_test.svg', '<svg>good</svg>');
 159         $storageDisk->put('uploads/svg_test.svg', '<svg>bad</svg>');
 160         $page->save();
 161
 162         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 163
 164         $storageDisk->delete('uploads/images/gallery/svg_test.svg');
 165         $storageDisk->delete('uploads/svg_test.svg');
 166
 167         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test.svg', false);
 168         $resp->assertSee('http://localhost/uploads/svg_test.svg');
 169         $resp->assertSee('src="/uploads/svg_test.svg"', false);
 170     }
 171
 172     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local()
 173     {
 174         $contents = file_get_contents(public_path('.htaccess'));
 175         config()->set('filesystems.images', 'local');
 176
 177         $page = $this->entities->page();
 178         $page->html = '<img src="http://localhost/uploads/images/../../.htaccess"/>';
 179         $page->save();
 180
 181         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 182         $resp->assertDontSee(base64_encode($contents));
 183     }
 184
 185     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local_secure()
 186     {
 187         $testFilePath = storage_path('logs/test.txt');
 188         config()->set('filesystems.images', 'local_secure');
 189         file_put_contents($testFilePath, 'I am a cat');
 190
 191         $page = $this->entities->page();
 192         $page->html = '<img src="http://localhost/uploads/images/../../logs/test.txt"/>';
 193         $page->save();
 194
 195         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 196         $resp->assertDontSee(base64_encode('I am a cat'));
 197         unlink($testFilePath);
 198     }
 199
 200     public function test_exports_removes_scripts_from_custom_head()
 201     {
 202         $entities = [
 203             Page::query()->first(), Chapter::query()->first(), Book::query()->first(),
 204         ];
 205         setting()->put('app-custom-head', '<script>window.donkey = "cat";</script><style>.my-test-class { color: red; }</style>');
 206
 207         foreach ($entities as $entity) {
 208             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 209             $resp->assertDontSee('window.donkey');
 210             $resp->assertDontSee('<script', false);
 211             $resp->assertSee('.my-test-class { color: red; }');
 212         }
 213     }
 214
 215     public function test_page_export_with_deleted_creator_and_updater()
 216     {
 217         $user = $this->users->viewer(['name' => 'ExportWizardTheFifth']);
 218         $page = $this->entities->page();
 219         $page->created_by = $user->id;
 220         $page->updated_by = $user->id;
 221         $page->save();
 222
 223         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 224         $resp->assertSee('ExportWizardTheFifth');
 225
 226         $user->delete();
 227         $resp = $this->get($page->getUrl('/export/html'));
 228         $resp->assertStatus(200);
 229         $resp->assertDontSee('ExportWizardTheFifth');
 230     }
 231
 232     public function test_html_exports_contain_csp_meta_tag()
 233     {
 234         $entities = [
 235             $this->entities->page(),
 236             $this->entities->book(),
 237             $this->entities->chapter(),
 238         ];
 239
 240         foreach ($entities as $entity) {
 241             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 242             $this->withHtml($resp)->assertElementExists('head meta[http-equiv="Content-Security-Policy"][content*="script-src "]');
 243         }
 244     }
 245
 246     public function test_html_exports_contain_body_classes_for_export_identification()
 247     {
 248         $page = $this->entities->page();
 249
 250         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 251         $this->withHtml($resp)->assertElementExists('body.export.export-format-html.export-engine-none');
 252     }
 253 }