BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

1 <?php

2

3 namespace Tests\Entity;

4

5 use BookStack\Entities\Models\Page;

6 use BookStack\Entities\Tools\PageContent;

7 use Tests\TestCase;

8 use Tests\Uploads\UsesImages;

9

10 class PageContentTest extends TestCase

11 {

12 use UsesImages;

13

14 protected $base64Jpeg = '/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=';

15

16 public function test_page_includes()

17 {

18 $page = Page::query()->first();

19 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

20

21 $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";

22 $secondPage->save();

23

24 $this->asEditor();

25

26 $pageContent = $this->get($page->getUrl());

27 $pageContent->assertDontSee('Hello, This is a test');

28

29 $originalHtml = $page->html;

30 $page->html .= "{{@{$secondPage->id}}}";

31 $page->save();

32

33 $pageContent = $this->get($page->getUrl());

34 $pageContent->assertSee('Hello, This is a test');

35 $pageContent->assertSee('This is a second block of content');

36

37 $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";

38 $page->save();

39

40 $pageContent = $this->get($page->getUrl());

41 $pageContent->assertDontSee('Hello, This is a test');

42 $pageContent->assertSee('Well This is a second block of content');

43 }

44

45 public function test_saving_page_with_includes()

46 {

47 $page = Page::query()->first();

48 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

49

50 $this->asEditor();

51 $includeTag = '{{@' . $secondPage->id . '}}';

52 $page->html = '<p>' . $includeTag . '</p>';

53

54 $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);

55

56 $resp->assertStatus(302);

57

58 $page = Page::find($page->id);

59 $this->assertStringContainsString($includeTag, $page->html);

60 $this->assertEquals('', $page->text);

61 }

62

63 public function test_page_includes_do_not_break_tables()

64 {

65 /** @var Page $page */

66 $page = Page::query()->first();

67 /** @var Page $secondPage */

68 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

69

70 $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';

71 $secondPage->html = $content;

72 $secondPage->save();

73

74 $page->html = "{{@{$secondPage->id}#table}}";

75 $page->save();

76

77 $pageResp = $this->asEditor()->get($page->getUrl());

78 $pageResp->assertSee($content, false);

79 }

80

81 public function test_page_includes_do_not_break_code()

82 {

83 /** @var Page $page */

84 $page = Page::query()->first();

85 /** @var Page $secondPage */

86 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

87

88 $content = '<pre id="bkmrk-code"><code>var cat = null;</code></pre>';

89 $secondPage->html = $content;

90 $secondPage->save();

91

92 $page->html = "{{@{$secondPage->id}#bkmrk-code}}";

93 $page->save();

94

95 $pageResp = $this->asEditor()->get($page->getUrl());

96 $pageResp->assertSee($content, false);

97 }

98

99 public function test_page_includes_rendered_on_book_export()

100 {

101 $page = Page::query()->first();

102 $secondPage = Page::query()

103 ->where('book_id', '!=', $page->book_id)

104 ->first();

105

106 $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';

107 $secondPage->html = $content;

108 $secondPage->save();

109

110 $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";

111 $page->save();

112

113 $this->asEditor();

114 $htmlContent = $this->get($page->book->getUrl('/export/html'));

115 $htmlContent->assertSee('my cat is awesome and scratchy');

116 }

117

118 public function test_page_content_scripts_removed_by_default()

119 {

120 $this->asEditor();

121 $page = Page::query()->first();

122 $script = 'abc123<script>console.log("hello-test")</script>abc123';

123 $page->html = "escape {$script}";

124 $page->save();

125

126 $pageView = $this->get($page->getUrl());

127 $pageView->assertStatus(200);

128 $pageView->assertDontSee($script, false);

129 $pageView->assertSee('abc123abc123');

130 }

131

132 public function test_more_complex_content_script_escaping_scenarios()

133 {

134 $checks = [

135 "<p>Some script</p><script>alert('cat')</script>",

136 "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",

137 "<p>Some script<script>alert('cat')</script></p>",

138 "<p>Some script <div><script>alert('cat')</script></div></p>",

139 "<p>Some script <script><div>alert('cat')</script></div></p>",

140 "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",

141 ];

142

143 $this->asEditor();

144 $page = Page::query()->first();

145

146 foreach ($checks as $check) {

147 $page->html = $check;

148 $page->save();

149

150 $pageView = $this->get($page->getUrl());

151 $pageView->assertStatus(200);

152 $pageView->assertElementNotContains('.page-content', '<script>');

153 $pageView->assertElementNotContains('.page-content', '</script>');

154 }

155 }

156

157 public function test_js_and_base64_src_urls_are_removed()

158 {

159 $checks = [

160 '<iframe src="javascript:alert(document.cookie)"></iframe>',

161 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

162 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

163 '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',

164 '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

165 '<iframe src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

166 '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

167 '<img src="javascript:alert(document.cookie)"/>',

168 '<img src="JavAScRipT:alert(document.cookie)"/>',

169 '<img src="JavAScRipT:alert(document.cookie)"/>',

170 '<img SRC=" javascript: alert(document.cookie)"/>',

171 '<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

172 '<img src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

173 '<img src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

174 '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>',

175 '<iframe SRCdoc="<script>window.alert(document.cookie)</script>"></iframe>',

176 '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',

177 ];

178

179 $this->asEditor();

180 $page = Page::query()->first();

181

182 foreach ($checks as $check) {

183 $page->html = $check;

184 $page->save();

185

186 $pageView = $this->get($page->getUrl());

187 $pageView->assertStatus(200);

188 $pageView->assertElementNotContains('.page-content', '<iframe>');

189 $pageView->assertElementNotContains('.page-content', '<img');

190 $pageView->assertElementNotContains('.page-content', '</iframe>');

191 $pageView->assertElementNotContains('.page-content', 'src=');

192 $pageView->assertElementNotContains('.page-content', 'javascript:');

193 $pageView->assertElementNotContains('.page-content', 'data:');

194 $pageView->assertElementNotContains('.page-content', 'base64');

195 }

196 }

197

198 public function test_javascript_uri_links_are_removed()

199 {

200 $checks = [

201 '<a id="xss" href="javascript:alert(document.cookie)>Click me</a>',

202 '<a id="xss" href="javascript: alert(document.cookie)>Click me</a>',

203 '<a id="xss" href="JaVaScRiPt: alert(document.cookie)>Click me</a>',

204 '<a id="xss" href=" JaVaScRiPt: alert(document.cookie)>Click me</a>',

205 ];

206

207 $this->asEditor();

208 $page = Page::query()->first();

209

210 foreach ($checks as $check) {

211 $page->html = $check;

212 $page->save();

213

214 $pageView = $this->get($page->getUrl());

215 $pageView->assertStatus(200);

216 $pageView->assertElementNotContains('.page-content', '<a id="xss"');

217 $pageView->assertElementNotContains('.page-content', 'href=javascript:');

218 }

219 }

220

221 public function test_form_actions_with_javascript_are_removed()

222 {

223 $checks = [

224 '<form><input id="xss" type=submit formaction=javascript:alert(document.domain) value=Submit><input></form>',

225 '<form ><button id="xss" formaction="JaVaScRiPt:alert(document.domain)">Click me</button></form>',

226 '<form ><button id="xss" formaction=javascript:alert(document.domain)>Click me</button></form>',

227 '<form id="xss" action=javascript:alert(document.domain)><input type=submit value=Submit></form>',

228 '<form id="xss" action="JaVaScRiPt:alert(document.domain)"><input type=submit value=Submit></form>',

229 ];

230

231 $this->asEditor();

232 $page = Page::query()->first();

233

234 foreach ($checks as $check) {

235 $page->html = $check;

236 $page->save();

237

238 $pageView = $this->get($page->getUrl());

239 $pageView->assertStatus(200);

240 $pageView->assertElementNotContains('.page-content', '<button id="xss"');

241 $pageView->assertElementNotContains('.page-content', '<input id="xss"');

242 $pageView->assertElementNotContains('.page-content', '<form id="xss"');

243 $pageView->assertElementNotContains('.page-content', 'action=javascript:');

244 $pageView->assertElementNotContains('.page-content', 'formaction=javascript:');

245 }

246 }

247

248 public function test_metadata_redirects_are_removed()

249 {

250 $checks = [

251 '<meta http-equiv="refresh" content="0; url=//external_url">',

252 '<meta http-equiv="refresh" ConTeNt="0; url=//external_url">',

253 '<meta http-equiv="refresh" content="0; UrL=//external_url">',

254 ];

255

256 $this->asEditor();

257 $page = Page::query()->first();

258

259 foreach ($checks as $check) {

260 $page->html = $check;

261 $page->save();

262

263 $pageView = $this->get($page->getUrl());

264 $pageView->assertStatus(200);

265 $pageView->assertElementNotContains('.page-content', '<meta>');

266 $pageView->assertElementNotContains('.page-content', '</meta>');

267 $pageView->assertElementNotContains('.page-content', 'content=');

268 $pageView->assertElementNotContains('.page-content', 'external_url');

269 }

270 }

271

272 public function test_page_inline_on_attributes_removed_by_default()

273 {

274 $this->asEditor();

275 $page = Page::query()->first();

276 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

277 $page->html = "escape {$script}";

278 $page->save();

279

280 $pageView = $this->get($page->getUrl());

281 $pageView->assertStatus(200);

282 $pageView->assertDontSee($script, false);

283 $pageView->assertSee('<p>Hello</p>', false);

284 }

285

286 public function test_more_complex_inline_on_attributes_escaping_scenarios()

287 {

288 $checks = [

289 '<p onclick="console.log(\'test\')">Hello</p>',

290 '<p OnCliCk="console.log(\'test\')">Hello</p>',

291 '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',

292 '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',

293 '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',

294 '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',

295 '<a a="<img src=1 onerror=\'alert(1)\'> ',

296 '\<a onclick="alert(document.cookie)"\>xss link\</a\>',

297 ];

298

299 $this->asEditor();

300 $page = Page::query()->first();

301

302 foreach ($checks as $check) {

303 $page->html = $check;

304 $page->save();

305

306 $pageView = $this->get($page->getUrl());

307 $pageView->assertStatus(200);

308 $pageView->assertElementNotContains('.page-content', 'onclick');

309 }

310 }

311

312 public function test_page_content_scripts_show_when_configured()

313 {

314 $this->asEditor();

315 $page = Page::query()->first();

316 config()->push('app.allow_content_scripts', 'true');

317

318 $script = 'abc123<script>console.log("hello-test")</script>abc123';

319 $page->html = "no escape {$script}";

320 $page->save();

321

322 $pageView = $this->get($page->getUrl());

323 $pageView->assertSee($script, false);

324 $pageView->assertDontSee('abc123abc123');

325 }

326

327 public function test_svg_xlink_hrefs_are_removed()

328 {

329 $checks = [

330 '<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',

331 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>',

332 ];

333

334 $this->asEditor();

335 $page = Page::query()->first();

336

337 foreach ($checks as $check) {

338 $page->html = $check;

339 $page->save();

340

341 $pageView = $this->get($page->getUrl());

342 $pageView->assertStatus(200);

343 $pageView->assertElementNotContains('.page-content', 'alert');

344 $pageView->assertElementNotContains('.page-content', 'xlink:href');

345 $pageView->assertElementNotContains('.page-content', 'application/xml');

346 }

347 }

348

349 public function test_page_inline_on_attributes_show_if_configured()

350 {

351 $this->asEditor();

352 $page = Page::query()->first();

353 config()->push('app.allow_content_scripts', 'true');

354

355 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

356 $page->html = "escape {$script}";

357 $page->save();

358

359 $pageView = $this->get($page->getUrl());

360 $pageView->assertSee($script, false);

361 $pageView->assertDontSee('<p>Hello</p>', false);

362 }

363

364 public function test_duplicate_ids_does_not_break_page_render()

365 {

366 $this->asEditor();

367 $pageA = Page::query()->first();

368 $pageB = Page::query()->where('id', '!=', $pageA->id)->first();

369

370 $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';

371 $pageA->html = $content;

372 $pageA->save();

373

374 $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@' . $pageA->id . '#test}}</p>';

375 $pageB->save();

376

377 $pageView = $this->get($pageB->getUrl());

378 $pageView->assertSuccessful();

379 }

380

381 public function test_duplicate_ids_fixed_on_page_save()

382 {

383 $this->asEditor();

384 $page = Page::query()->first();

385

386 $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';

387 $pageSave = $this->put($page->getUrl(), [

388 'name' => $page->name,

389 'html' => $content,

390 'summary' => '',

391 ]);

392 $pageSave->assertRedirect();

393

394 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

395 $this->assertEquals(substr_count($updatedPage->html, 'bkmrk-test"'), 1);

396 }

397

398 public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()

399 {

400 $this->asEditor();

401 $page = Page::query()->first();

402

403 $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';

404 $this->put($page->getUrl(), [

405 'name' => $page->name,

406 'html' => $content,

407 'summary' => '',

408 ]);

409

410 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

411 $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);

412 $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);

413 }

414

415 public function test_get_page_nav_sets_correct_properties()

416 {

417 $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';

418 $pageContent = new PageContent(new Page(['html' => $content]));

419 $navMap = $pageContent->getNavigation($content);

420

421 $this->assertCount(3, $navMap);

422 $this->assertArrayMapIncludes([

423 'nodeName' => 'h1',

424 'link' => '#testa',

425 'text' => 'Hello',

426 'level' => 1,

427 ], $navMap[0]);

428 $this->assertArrayMapIncludes([

429 'nodeName' => 'h2',

430 'link' => '#testb',

431 'text' => 'There',

432 'level' => 2,

433 ], $navMap[1]);

434 $this->assertArrayMapIncludes([

435 'nodeName' => 'h3',

436 'link' => '#testc',

437 'text' => 'Donkey',

438 'level' => 3,

439 ], $navMap[2]);

440 }

441

442 public function test_get_page_nav_does_not_show_empty_titles()

443 {

444 $content = '<h1 id="testa">Hello</h1><h2 id="testb"> </h2><h3 id="testc"></h3>';

445 $pageContent = new PageContent(new Page(['html' => $content]));

446 $navMap = $pageContent->getNavigation($content);

447

448 $this->assertCount(1, $navMap);

449 $this->assertArrayMapIncludes([

450 'nodeName' => 'h1',

451 'link' => '#testa',

452 'text' => 'Hello',

453 ], $navMap[0]);

454 }

455

456 public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()

457 {

458 $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';

459 $pageContent = new PageContent(new Page(['html' => $content]));

460 $navMap = $pageContent->getNavigation($content);

461

462 $this->assertCount(3, $navMap);

463 $this->assertArrayMapIncludes([

464 'nodeName' => 'h4',

465 'level' => 1,

466 ], $navMap[0]);

467 $this->assertArrayMapIncludes([

468 'nodeName' => 'h5',

469 'level' => 2,

470 ], $navMap[1]);

471 $this->assertArrayMapIncludes([

472 'nodeName' => 'h6',

473 'level' => 3,

474 ], $navMap[2]);

475 }

476

477 public function test_page_text_decodes_html_entities()

478 {

479 $page = Page::query()->first();

480

481 $this->actingAs($this->getAdmin())

482 ->put($page->getUrl(''), [

483 'name' => 'Testing',

484 'html' => '<p>"Hello & welcome"</p>',

485 ]);

486

487 $page->refresh();

488 $this->assertEquals('"Hello & welcome"', $page->text);

489 }

490

491 public function test_page_markdown_table_rendering()

492 {

493 $this->asEditor();

494 $page = Page::query()->first();

495

496 $content = '| Syntax | Description |

497 | ----------- | ----------- |

498 | Header | Title |

499 | Paragraph | Text |';

500 $this->put($page->getUrl(), [

501 'name' => $page->name, 'markdown' => $content,

502 'html' => '', 'summary' => '',

503 ]);

504

505 $page->refresh();

506 $this->assertStringContainsString('</tbody>', $page->html);

507

508 $pageView = $this->get($page->getUrl());

509 $pageView->assertElementExists('.page-content table tbody td');

510 }

511

512 public function test_page_markdown_task_list_rendering()

513 {

514 $this->asEditor();

515 $page = Page::query()->first();

516

517 $content = '- [ ] Item a

518 - [x] Item b';

519 $this->put($page->getUrl(), [

520 'name' => $page->name, 'markdown' => $content,

521 'html' => '', 'summary' => '',

522 ]);

523

524 $page->refresh();

525 $this->assertStringContainsString('input', $page->html);

526 $this->assertStringContainsString('type="checkbox"', $page->html);

527

528 $pageView = $this->get($page->getUrl());

529 $pageView->assertElementExists('.page-content li.task-list-item input[type=checkbox]');

530 $pageView->assertElementExists('.page-content li.task-list-item input[type=checkbox][checked=checked]');

531 }

532

533 public function test_page_markdown_strikethrough_rendering()

534 {

535 $this->asEditor();

536 $page = Page::query()->first();

537

538 $content = '~~some crossed out text~~';

539 $this->put($page->getUrl(), [

540 'name' => $page->name, 'markdown' => $content,

541 'html' => '', 'summary' => '',

542 ]);

543

544 $page->refresh();

545 $this->assertStringMatchesFormat('%A<s%A>some crossed out text</s>%A', $page->html);

546

547 $pageView = $this->get($page->getUrl());

548 $pageView->assertElementExists('.page-content p > s');

549 }

550

551 public function test_page_markdown_single_html_comment_saving()

552 {

553 $this->asEditor();

554 $page = Page::query()->first();

555

556 $content = '';

557 $this->put($page->getUrl(), [

558 'name' => $page->name, 'markdown' => $content,

559 'html' => '', 'summary' => '',

560 ]);

561

562 $page->refresh();

563 $this->assertStringMatchesFormat($content, $page->html);

564

565 $pageView = $this->get($page->getUrl());

566 $pageView->assertStatus(200);

567 $pageView->assertSee($content, false);

568 }

569

570 public function test_base64_images_get_extracted_from_page_content()

571 {

572 $this->asEditor();

573 $page = Page::query()->first();

574

575 $this->put($page->getUrl(), [

576 'name' => $page->name, 'summary' => '',

577 'html' => '<p>test<img src="data:image/jpeg;base64,' . $this->base64Jpeg . '"/></p>',

578 ]);

579

580 $page->refresh();

581 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.jpeg">%A</p>%A', $page->html);

582

583 $matches = [];

584 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

585 $imagePath = $matches[1];

586 $imageFile = public_path($imagePath);

587 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

588

589 $this->deleteImage($imagePath);

590 }

591

592 public function test_base64_images_get_extracted_when_containing_whitespace()

593 {

594 $this->asEditor();

595 $page = Page::query()->first();

596

597 $base64PngWithWhitespace = "iVBORw0KGg\noAAAANSUhE\tUgAAAAEAAAA BCA YAAAAfFcSJAAA\n\t ACklEQVR4nGMAAQAABQAB";

598 $base64PngWithoutWhitespace = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQAB';

599 $this->put($page->getUrl(), [

600 'name' => $page->name, 'summary' => '',

601 'html' => '<p>test<img src="data:image/png;base64,' . $base64PngWithWhitespace . '"/></p>',

602 ]);

603

604 $page->refresh();

605 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.png">%A</p>%A', $page->html);

606

607 $matches = [];

608 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

609 $imagePath = $matches[1];

610 $imageFile = public_path($imagePath);

611 $this->assertEquals(base64_decode($base64PngWithoutWhitespace), file_get_contents($imageFile));

612

613 $this->deleteImage($imagePath);

614 }

615

616 public function test_base64_images_within_html_blanked_if_not_supported_extension_for_extract()

617 {

618 // Relevant to https://github.com/BookStackApp/BookStack/issues/3010 and other cases

619 $extensions = [

620 'jiff', 'pngr', 'png ', ' png', '.png', 'png.', 'p.ng', ',png',

621 'data:image/png', ',data:image/png',

622 ];

623

624 foreach ($extensions as $extension) {

625 $this->asEditor();

626 $page = Page::query()->first();

627

628 $this->put($page->getUrl(), [

629 'name' => $page->name, 'summary' => '',

630 'html' => '<p>test<img src="data:image/' . $extension . ';base64,' . $this->base64Jpeg . '"/></p>',

631 ]);

632

633 $page->refresh();

634 $this->assertStringContainsString('<img src=""', $page->html);

635 }

636 }

637

638 public function test_base64_images_get_extracted_from_markdown_page_content()

639 {

640 $this->asEditor();

641 $page = Page::query()->first();

642

643 $this->put($page->getUrl(), [

644 'name' => $page->name, 'summary' => '',

645 'markdown' => 'test ![test](data:image/jpeg;base64,' . $this->base64Jpeg . ')',

646 ]);

647

648 $page->refresh();

649 $this->assertStringMatchesFormat('%A<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

650

651 $matches = [];

652 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

653 $imagePath = $matches[1];

654 $imageFile = public_path($imagePath);

655 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

656

657 $this->deleteImage($imagePath);

658 }

659

660 public function test_markdown_base64_extract_not_limited_by_pcre_limits()

661 {

662 $pcreBacktrackLimit = ini_get('pcre.backtrack_limit');

663 $pcreRecursionLimit = ini_get('pcre.recursion_limit');

664

665 $this->asEditor();

666 $page = Page::query()->first();

667

668 ini_set('pcre.backtrack_limit', '500');

669 ini_set('pcre.recursion_limit', '500');

670

671 $content = str_repeat('a', 5000);

672 $base64Content = base64_encode($content);

673

674 $this->put($page->getUrl(), [

675 'name' => $page->name, 'summary' => '',

676 'markdown' => 'test ![test](data:image/jpeg;base64,' . $base64Content . ') ![test](data:image/jpeg;base64,' . $base64Content . ')',

677 ]);

678

679 $page->refresh();

680 $this->assertStringMatchesFormat('<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test"> <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

681

682 $matches = [];

683 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

684 $imagePath = $matches[1];

685 $imageFile = public_path($imagePath);

686 $this->assertEquals($content, file_get_contents($imageFile));

687

688 $this->deleteImage($imagePath);

689 ini_set('pcre.backtrack_limit', $pcreBacktrackLimit);

690 ini_set('pcre.recursion_limit', $pcreRecursionLimit);

691 }

692