BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

1 <?php

3 namespace Tests\Entity;

5 use BookStack\Entities\Models\Page;

6 use BookStack\Entities\Tools\PageContent;

7 use Tests\TestCase;

8 use Tests\Uploads\UsesImages;

10 class PageContentTest extends TestCase

11 {

12 use UsesImages;

14 protected $base64Jpeg = '/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=';

16 public function test_page_includes()

17 {

18 $page = Page::query()->first();

19 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

21 $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";

22 $secondPage->save();

24 $this->asEditor();

26 $pageContent = $this->get($page->getUrl());

27 $pageContent->assertDontSee('Hello, This is a test');

29 $originalHtml = $page->html;

30 $page->html .= "{{@{$secondPage->id}}}";

31 $page->save();

33 $pageContent = $this->get($page->getUrl());

34 $pageContent->assertSee('Hello, This is a test');

35 $pageContent->assertSee('This is a second block of content');

37 $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";

38 $page->save();

40 $pageContent = $this->get($page->getUrl());

41 $pageContent->assertDontSee('Hello, This is a test');

42 $pageContent->assertSee('Well This is a second block of content');

43 }

45 public function test_saving_page_with_includes()

46 {

47 $page = Page::query()->first();

48 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

50 $this->asEditor();

51 $includeTag = '{{@' . $secondPage->id . '}}';

52 $page->html = '<p>' . $includeTag . '</p>';

54 $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);

56 $resp->assertStatus(302);

58 $page = Page::find($page->id);

59 $this->assertStringContainsString($includeTag, $page->html);

60 $this->assertEquals('', $page->text);

61 }

63 public function test_page_includes_do_not_break_tables()

64 {

65 $page = Page::query()->first();

66 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

68 $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';

69 $secondPage->html = $content;

70 $secondPage->save();

72 $page->html = "{{@{$secondPage->id}#table}}";

73 $page->save();

75 $this->asEditor();

76 $pageResp = $this->get($page->getUrl());

77 $pageResp->assertSee($content);

78 }

80 public function test_page_includes_rendered_on_book_export()

81 {

82 $page = Page::query()->first();

83 $secondPage = Page::query()

84 ->where('book_id', '!=', $page->book_id)

85 ->first();

87 $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';

88 $secondPage->html = $content;

89 $secondPage->save();

91 $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";

92 $page->save();

94 $this->asEditor();

95 $htmlContent = $this->get($page->book->getUrl('/export/html'));

96 $htmlContent->assertSee('my cat is awesome and scratchy');

97 }

99 public function test_page_content_scripts_removed_by_default()

100 {

101 $this->asEditor();

102 $page = Page::query()->first();

103 $script = 'abc123<script>console.log("hello-test")</script>abc123';

104 $page->html = "escape {$script}";

105 $page->save();

106

107 $pageView = $this->get($page->getUrl());

108 $pageView->assertStatus(200);

109 $pageView->assertDontSee($script);

110 $pageView->assertSee('abc123abc123');

111 }

112

113 public function test_more_complex_content_script_escaping_scenarios()

114 {

115 $checks = [

116 "<p>Some script</p><script>alert('cat')</script>",

117 "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",

118 "<p>Some script<script>alert('cat')</script></p>",

119 "<p>Some script <div><script>alert('cat')</script></div></p>",

120 "<p>Some script <script><div>alert('cat')</script></div></p>",

121 "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",

122 ];

123

124 $this->asEditor();

125 $page = Page::query()->first();

126

127 foreach ($checks as $check) {

128 $page->html = $check;

129 $page->save();

130

131 $pageView = $this->get($page->getUrl());

132 $pageView->assertStatus(200);

133 $pageView->assertElementNotContains('.page-content', '<script>');

134 $pageView->assertElementNotContains('.page-content', '</script>');

135 }

136 }

137

138 public function test_iframe_js_and_base64_urls_are_removed()

139 {

140 $checks = [

141 '<iframe src="javascript:alert(document.cookie)"></iframe>',

142 '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',

143 '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

144 '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

145 '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>',

146 ];

147

148 $this->asEditor();

149 $page = Page::query()->first();

150

151 foreach ($checks as $check) {

152 $page->html = $check;

153 $page->save();

154

155 $pageView = $this->get($page->getUrl());

156 $pageView->assertStatus(200);

157 $pageView->assertElementNotContains('.page-content', '<iframe>');

158 $pageView->assertElementNotContains('.page-content', '</iframe>');

159 $pageView->assertElementNotContains('.page-content', 'src=');

160 $pageView->assertElementNotContains('.page-content', 'javascript:');

161 $pageView->assertElementNotContains('.page-content', 'data:');

162 $pageView->assertElementNotContains('.page-content', 'base64');

163 }

164 }

165

166 public function test_javascript_uri_links_are_removed()

167 {

168 $checks = [

169 '<a id="xss" href="javascript:alert(document.cookie)>Click me</a>',

170 '<a id="xss" href="javascript: alert(document.cookie)>Click me</a>',

171 ];

172

173 $this->asEditor();

174 $page = Page::query()->first();

175

176 foreach ($checks as $check) {

177 $page->html = $check;

178 $page->save();

179

180 $pageView = $this->get($page->getUrl());

181 $pageView->assertStatus(200);

182 $pageView->assertElementNotContains('.page-content', '<a id="xss">');

183 $pageView->assertElementNotContains('.page-content', 'href=javascript:');

184 }

185 }

186

187 public function test_form_actions_with_javascript_are_removed()

188 {

189 $checks = [

190 '<form><input id="xss" type=submit formaction=javascript:alert(document.domain) value=Submit><input></form>',

191 '<form ><button id="xss" formaction=javascript:alert(document.domain)>Click me</button></form>',

192 '<form id="xss" action=javascript:alert(document.domain)><input type=submit value=Submit></form>',

193 ];

194

195 $this->asEditor();

196 $page = Page::query()->first();

197

198 foreach ($checks as $check) {

199 $page->html = $check;

200 $page->save();

201

202 $pageView = $this->get($page->getUrl());

203 $pageView->assertStatus(200);

204 $pageView->assertElementNotContains('.page-content', '<button id="xss"');

205 $pageView->assertElementNotContains('.page-content', '<input id="xss"');

206 $pageView->assertElementNotContains('.page-content', '<form id="xss"');

207 $pageView->assertElementNotContains('.page-content', 'action=javascript:');

208 $pageView->assertElementNotContains('.page-content', 'formaction=javascript:');

209 }

210 }

211

212 public function test_metadata_redirects_are_removed()

213 {

214 $checks = [

215 '<meta http-equiv="refresh" content="0; url=//external_url">',

216 ];

217

218 $this->asEditor();

219 $page = Page::query()->first();

220

221 foreach ($checks as $check) {

222 $page->html = $check;

223 $page->save();

224

225 $pageView = $this->get($page->getUrl());

226 $pageView->assertStatus(200);

227 $pageView->assertElementNotContains('.page-content', '<meta>');

228 $pageView->assertElementNotContains('.page-content', '</meta>');

229 $pageView->assertElementNotContains('.page-content', 'content=');

230 $pageView->assertElementNotContains('.page-content', 'external_url');

231 }

232 }

233

234 public function test_page_inline_on_attributes_removed_by_default()

235 {

236 $this->asEditor();

237 $page = Page::query()->first();

238 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

239 $page->html = "escape {$script}";

240 $page->save();

241

242 $pageView = $this->get($page->getUrl());

243 $pageView->assertStatus(200);

244 $pageView->assertDontSee($script);

245 $pageView->assertSee('<p>Hello</p>');

246 }

247

248 public function test_more_complex_inline_on_attributes_escaping_scenarios()

249 {

250 $checks = [

251 '<p onclick="console.log(\'test\')">Hello</p>',

252 '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',

253 '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',

254 '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',

255 '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',

256 '<a a="<img src=1 onerror=\'alert(1)\'> ',

257 ];

258

259 $this->asEditor();

260 $page = Page::query()->first();

261

262 foreach ($checks as $check) {

263 $page->html = $check;

264 $page->save();

265

266 $pageView = $this->get($page->getUrl());

267 $pageView->assertStatus(200);

268 $pageView->assertElementNotContains('.page-content', 'onclick');

269 }

270 }

271

272 public function test_page_content_scripts_show_when_configured()

273 {

274 $this->asEditor();

275 $page = Page::query()->first();

276 config()->push('app.allow_content_scripts', 'true');

277

278 $script = 'abc123<script>console.log("hello-test")</script>abc123';

279 $page->html = "no escape {$script}";

280 $page->save();

281

282 $pageView = $this->get($page->getUrl());

283 $pageView->assertSee($script);

284 $pageView->assertDontSee('abc123abc123');

285 }

286

287 public function test_page_inline_on_attributes_show_if_configured()

288 {

289 $this->asEditor();

290 $page = Page::query()->first();

291 config()->push('app.allow_content_scripts', 'true');

292

293 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

294 $page->html = "escape {$script}";

295 $page->save();

296

297 $pageView = $this->get($page->getUrl());

298 $pageView->assertSee($script);

299 $pageView->assertDontSee('<p>Hello</p>');

300 }

301

302 public function test_duplicate_ids_does_not_break_page_render()

303 {

304 $this->asEditor();

305 $pageA = Page::query()->first();

306 $pageB = Page::query()->where('id', '!=', $pageA->id)->first();

307

308 $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';

309 $pageA->html = $content;

310 $pageA->save();

311

312 $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@' . $pageA->id . '#test}}</p>';

313 $pageB->save();

314

315 $pageView = $this->get($pageB->getUrl());

316 $pageView->assertSuccessful();

317 }

318

319 public function test_duplicate_ids_fixed_on_page_save()

320 {

321 $this->asEditor();

322 $page = Page::query()->first();

323

324 $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';

325 $pageSave = $this->put($page->getUrl(), [

326 'name' => $page->name,

327 'html' => $content,

328 'summary' => '',

329 ]);

330 $pageSave->assertRedirect();

331

332 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

333 $this->assertEquals(substr_count($updatedPage->html, 'bkmrk-test"'), 1);

334 }

335

336 public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()

337 {

338 $this->asEditor();

339 $page = Page::query()->first();

340

341 $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';

342 $this->put($page->getUrl(), [

343 'name' => $page->name,

344 'html' => $content,

345 'summary' => '',

346 ]);

347

348 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

349 $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);

350 $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);

351 }

352

353 public function test_get_page_nav_sets_correct_properties()

354 {

355 $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';

356 $pageContent = new PageContent(new Page(['html' => $content]));

357 $navMap = $pageContent->getNavigation($content);

358

359 $this->assertCount(3, $navMap);

360 $this->assertArrayMapIncludes([

361 'nodeName' => 'h1',

362 'link' => '#testa',

363 'text' => 'Hello',

364 'level' => 1,

365 ], $navMap[0]);

366 $this->assertArrayMapIncludes([

367 'nodeName' => 'h2',

368 'link' => '#testb',

369 'text' => 'There',

370 'level' => 2,

371 ], $navMap[1]);

372 $this->assertArrayMapIncludes([

373 'nodeName' => 'h3',

374 'link' => '#testc',

375 'text' => 'Donkey',

376 'level' => 3,

377 ], $navMap[2]);

378 }

379

380 public function test_get_page_nav_does_not_show_empty_titles()

381 {

382 $content = '<h1 id="testa">Hello</h1><h2 id="testb"> </h2><h3 id="testc"></h3>';

383 $pageContent = new PageContent(new Page(['html' => $content]));

384 $navMap = $pageContent->getNavigation($content);

385

386 $this->assertCount(1, $navMap);

387 $this->assertArrayMapIncludes([

388 'nodeName' => 'h1',

389 'link' => '#testa',

390 'text' => 'Hello',

391 ], $navMap[0]);

392 }

393

394 public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()

395 {

396 $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';

397 $pageContent = new PageContent(new Page(['html' => $content]));

398 $navMap = $pageContent->getNavigation($content);

399

400 $this->assertCount(3, $navMap);

401 $this->assertArrayMapIncludes([

402 'nodeName' => 'h4',

403 'level' => 1,

404 ], $navMap[0]);

405 $this->assertArrayMapIncludes([

406 'nodeName' => 'h5',

407 'level' => 2,

408 ], $navMap[1]);

409 $this->assertArrayMapIncludes([

410 'nodeName' => 'h6',

411 'level' => 3,

412 ], $navMap[2]);

413 }

414

415 public function test_page_text_decodes_html_entities()

416 {

417 $page = Page::query()->first();

418

419 $this->actingAs($this->getAdmin())

420 ->put($page->getUrl(''), [

421 'name' => 'Testing',

422 'html' => '<p>"Hello & welcome"</p>',

423 ]);

424

425 $page->refresh();

426 $this->assertEquals('"Hello & welcome"', $page->text);

427 }

428

429 public function test_page_markdown_table_rendering()

430 {

431 $this->asEditor();

432 $page = Page::query()->first();

433

434 $content = '| Syntax | Description |

435 | ----------- | ----------- |

436 | Header | Title |

437 | Paragraph | Text |';

438 $this->put($page->getUrl(), [

439 'name' => $page->name, 'markdown' => $content,

440 'html' => '', 'summary' => '',

441 ]);

442

443 $page->refresh();

444 $this->assertStringContainsString('</tbody>', $page->html);

445

446 $pageView = $this->get($page->getUrl());

447 $pageView->assertElementExists('.page-content table tbody td');

448 }

449

450 public function test_page_markdown_task_list_rendering()

451 {

452 $this->asEditor();

453 $page = Page::query()->first();

454

455 $content = '- [ ] Item a

456 - [x] Item b';

457 $this->put($page->getUrl(), [

458 'name' => $page->name, 'markdown' => $content,

459 'html' => '', 'summary' => '',

460 ]);

461

462 $page->refresh();

463 $this->assertStringContainsString('input', $page->html);

464 $this->assertStringContainsString('type="checkbox"', $page->html);

465

466 $pageView = $this->get($page->getUrl());

467 $pageView->assertElementExists('.page-content input[type=checkbox]');

468 }

469

470 public function test_page_markdown_strikethrough_rendering()

471 {

472 $this->asEditor();

473 $page = Page::query()->first();

474

475 $content = '~~some crossed out text~~';

476 $this->put($page->getUrl(), [

477 'name' => $page->name, 'markdown' => $content,

478 'html' => '', 'summary' => '',

479 ]);

480

481 $page->refresh();

482 $this->assertStringMatchesFormat('%A<s%A>some crossed out text</s>%A', $page->html);

483

484 $pageView = $this->get($page->getUrl());

485 $pageView->assertElementExists('.page-content p > s');

486 }

487

488 public function test_page_markdown_single_html_comment_saving()

489 {

490 $this->asEditor();

491 $page = Page::query()->first();

492

493 $content = '';

494 $this->put($page->getUrl(), [

495 'name' => $page->name, 'markdown' => $content,

496 'html' => '', 'summary' => '',

497 ]);

498

499 $page->refresh();

500 $this->assertStringMatchesFormat($content, $page->html);

501

502 $pageView = $this->get($page->getUrl());

503 $pageView->assertStatus(200);

504 $pageView->assertSee($content);

505 }

506

507 public function test_base64_images_get_extracted_from_page_content()

508 {

509 $this->asEditor();

510 $page = Page::query()->first();

511

512 $this->put($page->getUrl(), [

513 'name' => $page->name, 'summary' => '',

514 'html' => '<p>test<img src="data:image/jpeg;base64,' . $this->base64Jpeg . '"/></p>',

515 ]);

516

517 $page->refresh();

518 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.jpeg">%A</p>%A', $page->html);

519

520 $matches = [];

521 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

522 $imagePath = $matches[1];

523 $imageFile = public_path($imagePath);

524 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

525

526 $this->deleteImage($imagePath);

527 }

528

529 public function test_base64_images_get_extracted_when_containing_whitespace()

530 {

531 $this->asEditor();

532 $page = Page::query()->first();

533

534 $base64PngWithWhitespace = "iVBORw0KGg\noAAAANSUhE\tUgAAAAEAAAA BCA YAAAAfFcSJAAA\n\t ACklEQVR4nGMAAQAABQAB";

535 $base64PngWithoutWhitespace = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQAB';

536 $this->put($page->getUrl(), [

537 'name' => $page->name, 'summary' => '',

538 'html' => '<p>test<img src="data:image/png;base64,' . $base64PngWithWhitespace . '"/></p>',

539 ]);

540

541 $page->refresh();

542 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.png">%A</p>%A', $page->html);

543

544 $matches = [];

545 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

546 $imagePath = $matches[1];

547 $imageFile = public_path($imagePath);

548 $this->assertEquals(base64_decode($base64PngWithoutWhitespace), file_get_contents($imageFile));

549

550 $this->deleteImage($imagePath);

551 }

552

553 public function test_base64_images_blanked_if_not_supported_extension_for_extract()

554 {

555 $this->asEditor();

556 $page = Page::query()->first();

557

558 $this->put($page->getUrl(), [

559 'name' => $page->name, 'summary' => '',

560 'html' => '<p>test<img src="data:image/jiff;base64,' . $this->base64Jpeg . '"/></p>',

561 ]);

562

563 $page->refresh();

564 $this->assertStringContainsString('<img src=""', $page->html);

565 }

566 }