BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

1 <?php namespace Tests\Entity;

3 use BookStack\Entities\Managers\PageContent;

4 use BookStack\Entities\Page;

5 use Tests\TestCase;

7 class PageContentTest extends TestCase

8 {

10 public function test_page_includes()

11 {

12 $page = Page::first();

13 $secondPage = Page::where('id', '!=', $page->id)->first();

15 $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";

16 $secondPage->save();

18 $this->asEditor();

20 $pageContent = $this->get($page->getUrl());

21 $pageContent->assertDontSee('Hello, This is a test');

23 $originalHtml = $page->html;

24 $page->html .= "{{@{$secondPage->id}}}";

25 $page->save();

27 $pageContent = $this->get($page->getUrl());

28 $pageContent->assertSee('Hello, This is a test');

29 $pageContent->assertSee('This is a second block of content');

31 $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";

32 $page->save();

34 $pageContent = $this->get($page->getUrl());

35 $pageContent->assertDontSee('Hello, This is a test');

36 $pageContent->assertSee('Well This is a second block of content');

37 }

39 public function test_saving_page_with_includes()

40 {

41 $page = Page::first();

42 $secondPage = Page::where('id', '!=', $page->id)->first();

44 $this->asEditor();

45 $includeTag = '{{@' . $secondPage->id . '}}';

46 $page->html = '<p>' . $includeTag . '</p>';

48 $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);

50 $resp->assertStatus(302);

52 $page = Page::find($page->id);

53 $this->assertStringContainsString($includeTag, $page->html);

54 $this->assertEquals('', $page->text);

55 }

57 public function test_page_includes_do_not_break_tables()

58 {

59 $page = Page::first();

60 $secondPage = Page::where('id', '!=', $page->id)->first();

62 $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';

63 $secondPage->html = $content;

64 $secondPage->save();

66 $page->html = "{{@{$secondPage->id}#table}}";

67 $page->save();

69 $this->asEditor();

70 $pageResp = $this->get($page->getUrl());

71 $pageResp->assertSee($content);

72 }

74 public function test_page_includes_rendered_on_book_export()

75 {

76 $page = Page::query()->first();

77 $secondPage = Page::query()

78 ->where('book_id', '!=', $page->book_id)

79 ->first();

81 $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';

82 $secondPage->html = $content;

83 $secondPage->save();

85 $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";

86 $page->save();

88 $this->asEditor();

89 $htmlContent = $this->get($page->book->getUrl('/export/html'));

90 $htmlContent->assertSee('my cat is awesome and scratchy');

91 }

93 public function test_page_content_scripts_removed_by_default()

94 {

95 $this->asEditor();

96 $page = Page::first();

97 $script = 'abc123<script>console.log("hello-test")</script>abc123';

98 $page->html = "escape {$script}";

99 $page->save();

100

101 $pageView = $this->get($page->getUrl());

102 $pageView->assertStatus(200);

103 $pageView->assertDontSee($script);

104 $pageView->assertSee('abc123abc123');

105 }

106

107 public function test_more_complex_content_script_escaping_scenarios()

108 {

109 $checks = [

110 "<p>Some script</p><script>alert('cat')</script>",

111 "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",

112 "<p>Some script<script>alert('cat')</script></p>",

113 "<p>Some script <div><script>alert('cat')</script></div></p>",

114 "<p>Some script <script><div>alert('cat')</script></div></p>",

115 "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",

116 ];

117

118 $this->asEditor();

119 $page = Page::first();

120

121 foreach ($checks as $check) {

122 $page->html = $check;

123 $page->save();

124

125 $pageView = $this->get($page->getUrl());

126 $pageView->assertStatus(200);

127 $pageView->assertElementNotContains('.page-content', '<script>');

128 $pageView->assertElementNotContains('.page-content', '</script>');

129 }

130

131 }

132

133 public function test_iframe_js_and_base64_urls_are_removed()

134 {

135 $checks = [

136 '<iframe src="javascript:alert(document.cookie)"></iframe>',

137 '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',

138 '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

139 '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

140 '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>'

141 ];

142

143 $this->asEditor();

144 $page = Page::first();

145

146 foreach ($checks as $check) {

147 $page->html = $check;

148 $page->save();

149

150 $pageView = $this->get($page->getUrl());

151 $pageView->assertStatus(200);

152 $pageView->assertElementNotContains('.page-content', '<iframe>');

153 $pageView->assertElementNotContains('.page-content', '</iframe>');

154 $pageView->assertElementNotContains('.page-content', 'src=');

155 $pageView->assertElementNotContains('.page-content', 'javascript:');

156 $pageView->assertElementNotContains('.page-content', 'data:');

157 $pageView->assertElementNotContains('.page-content', 'base64');

158 }

159

160 }

161

162 public function test_page_inline_on_attributes_removed_by_default()

163 {

164 $this->asEditor();

165 $page = Page::first();

166 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

167 $page->html = "escape {$script}";

168 $page->save();

169

170 $pageView = $this->get($page->getUrl());

171 $pageView->assertStatus(200);

172 $pageView->assertDontSee($script);

173 $pageView->assertSee('<p>Hello</p>');

174 }

175

176 public function test_more_complex_inline_on_attributes_escaping_scenarios()

177 {

178 $checks = [

179 '<p onclick="console.log(\'test\')">Hello</p>',

180 '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',

181 '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',

182 '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',

183 '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',

184 '<a a="<img src=1 onerror=\'alert(1)\'> ',

185 ];

186

187 $this->asEditor();

188 $page = Page::first();

189

190 foreach ($checks as $check) {

191 $page->html = $check;

192 $page->save();

193

194 $pageView = $this->get($page->getUrl());

195 $pageView->assertStatus(200);

196 $pageView->assertElementNotContains('.page-content', 'onclick');

197 }

198

199 }

200

201 public function test_page_content_scripts_show_when_configured()

202 {

203 $this->asEditor();

204 $page = Page::first();

205 config()->push('app.allow_content_scripts', 'true');

206

207 $script = 'abc123<script>console.log("hello-test")</script>abc123';

208 $page->html = "no escape {$script}";

209 $page->save();

210

211 $pageView = $this->get($page->getUrl());

212 $pageView->assertSee($script);

213 $pageView->assertDontSee('abc123abc123');

214 }

215

216 public function test_page_inline_on_attributes_show_if_configured()

217 {

218 $this->asEditor();

219 $page = Page::first();

220 config()->push('app.allow_content_scripts', 'true');

221

222 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

223 $page->html = "escape {$script}";

224 $page->save();

225

226 $pageView = $this->get($page->getUrl());

227 $pageView->assertSee($script);

228 $pageView->assertDontSee('<p>Hello</p>');

229 }

230

231 public function test_duplicate_ids_does_not_break_page_render()

232 {

233 $this->asEditor();

234 $pageA = Page::first();

235 $pageB = Page::query()->where('id', '!=', $pageA->id)->first();

236

237 $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';

238 $pageA->html = $content;

239 $pageA->save();

240

241 $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@'. $pageA->id .'#test}}</p>';

242 $pageB->save();

243

244 $pageView = $this->get($pageB->getUrl());

245 $pageView->assertSuccessful();

246 }

247

248 public function test_duplicate_ids_fixed_on_page_save()

249 {

250 $this->asEditor();

251 $page = Page::first();

252

253 $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';

254 $pageSave = $this->put($page->getUrl(), [

255 'name' => $page->name,

256 'html' => $content,

257 'summary' => ''

258 ]);

259 $pageSave->assertRedirect();

260

261 $updatedPage = Page::where('id', '=', $page->id)->first();

262 $this->assertEquals(substr_count($updatedPage->html, "bkmrk-test\""), 1);

263 }

264

265 public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()

266 {

267 $this->asEditor();

268 $page = Page::first();

269

270 $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';

271 $this->put($page->getUrl(), [

272 'name' => $page->name,

273 'html' => $content,

274 'summary' => ''

275 ]);

276

277 $updatedPage = Page::where('id', '=', $page->id)->first();

278 $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);

279 $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);

280 }

281

282 public function test_get_page_nav_sets_correct_properties()

283 {

284 $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';

285 $pageContent = new PageContent(new Page(['html' => $content]));

286 $navMap = $pageContent->getNavigation($content);

287

288 $this->assertCount(3, $navMap);

289 $this->assertArrayMapIncludes([

290 'nodeName' => 'h1',

291 'link' => '#testa',

292 'text' => 'Hello',

293 'level' => 1,

294 ], $navMap[0]);

295 $this->assertArrayMapIncludes([

296 'nodeName' => 'h2',

297 'link' => '#testb',

298 'text' => 'There',

299 'level' => 2,

300 ], $navMap[1]);

301 $this->assertArrayMapIncludes([

302 'nodeName' => 'h3',

303 'link' => '#testc',

304 'text' => 'Donkey',

305 'level' => 3,

306 ], $navMap[2]);

307 }

308

309 public function test_get_page_nav_does_not_show_empty_titles()

310 {

311 $content = '<h1 id="testa">Hello</h1><h2 id="testb"> </h2><h3 id="testc"></h3>';

312 $pageContent = new PageContent(new Page(['html' => $content]));

313 $navMap = $pageContent->getNavigation($content);

314

315 $this->assertCount(1, $navMap);

316 $this->assertArrayMapIncludes([

317 'nodeName' => 'h1',

318 'link' => '#testa',

319 'text' => 'Hello'

320 ], $navMap[0]);

321 }

322

323 public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()

324 {

325 $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';

326 $pageContent = new PageContent(new Page(['html' => $content]));

327 $navMap = $pageContent->getNavigation($content);

328

329 $this->assertCount(3, $navMap);

330 $this->assertArrayMapIncludes([

331 'nodeName' => 'h4',

332 'level' => 1,

333 ], $navMap[0]);

334 $this->assertArrayMapIncludes([

335 'nodeName' => 'h5',

336 'level' => 2,

337 ], $navMap[1]);

338 $this->assertArrayMapIncludes([

339 'nodeName' => 'h6',

340 'level' => 3,

341 ], $navMap[2]);

342 }

343

344 public function test_page_text_decodes_html_entities()

345 {

346 $page = Page::query()->first();

347

348 $this->actingAs($this->getAdmin())

349 ->put($page->getUrl(''), [

350 'name' => 'Testing',

351 'html' => '<p>"Hello & welcome"</p>',

352 ]);

353

354 $page->refresh();

355 $this->assertEquals('"Hello & welcome"', $page->text);

356 }

357 }