BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

1 <?php

2

3 namespace Tests\Entity;

4

5 use BookStack\Entities\Models\Page;

6 use BookStack\Entities\Tools\PageContent;

7 use Tests\TestCase;

8 use Tests\Uploads\UsesImages;

9

10 class PageContentTest extends TestCase

11 {

12 use UsesImages;

13

14 protected $base64Jpeg = '/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=';

15

16 public function test_page_includes()

17 {

18 $page = Page::query()->first();

19 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

20

21 $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";

22 $secondPage->save();

23

24 $this->asEditor();

25

26 $pageContent = $this->get($page->getUrl());

27 $pageContent->assertDontSee('Hello, This is a test');

28

29 $originalHtml = $page->html;

30 $page->html .= "{{@{$secondPage->id}}}";

31 $page->save();

32

33 $pageContent = $this->get($page->getUrl());

34 $pageContent->assertSee('Hello, This is a test');

35 $pageContent->assertSee('This is a second block of content');

36

37 $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";

38 $page->save();

39

40 $pageContent = $this->get($page->getUrl());

41 $pageContent->assertDontSee('Hello, This is a test');

42 $pageContent->assertSee('Well This is a second block of content');

43 }

44

45 public function test_saving_page_with_includes()

46 {

47 $page = Page::query()->first();

48 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

49

50 $this->asEditor();

51 $includeTag = '{{@' . $secondPage->id . '}}';

52 $page->html = '<p>' . $includeTag . '</p>';

53

54 $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);

55

56 $resp->assertStatus(302);

57

58 $page = Page::find($page->id);

59 $this->assertStringContainsString($includeTag, $page->html);

60 $this->assertEquals('', $page->text);

61 }

62

63 public function test_page_includes_do_not_break_tables()

64 {

65 /** @var Page $page */

66 $page = Page::query()->first();

67 /** @var Page $secondPage */

68 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

69

70 $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';

71 $secondPage->html = $content;

72 $secondPage->save();

73

74 $page->html = "{{@{$secondPage->id}#table}}";

75 $page->save();

76

77 $pageResp = $this->asEditor()->get($page->getUrl());

78 $pageResp->assertSee($content, false);

79 }

80

81 public function test_page_includes_do_not_break_code()

82 {

83 /** @var Page $page */

84 $page = Page::query()->first();

85 /** @var Page $secondPage */

86 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

87

88 $content = '<pre id="bkmrk-code"><code>var cat = null;</code></pre>';

89 $secondPage->html = $content;

90 $secondPage->save();

91

92 $page->html = "{{@{$secondPage->id}#bkmrk-code}}";

93 $page->save();

94

95 $pageResp = $this->asEditor()->get($page->getUrl());

96 $pageResp->assertSee($content, false);

97 }

98

99 public function test_page_includes_rendered_on_book_export()

100 {

101 $page = Page::query()->first();

102 $secondPage = Page::query()

103 ->where('book_id', '!=', $page->book_id)

104 ->first();

105

106 $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';

107 $secondPage->html = $content;

108 $secondPage->save();

109

110 $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";

111 $page->save();

112

113 $this->asEditor();

114 $htmlContent = $this->get($page->book->getUrl('/export/html'));

115 $htmlContent->assertSee('my cat is awesome and scratchy');

116 }

117

118 public function test_page_content_scripts_removed_by_default()

119 {

120 $this->asEditor();

121 $page = Page::query()->first();

122 $script = 'abc123<script>console.log("hello-test")</script>abc123';

123 $page->html = "escape {$script}";

124 $page->save();

125

126 $pageView = $this->get($page->getUrl());

127 $pageView->assertStatus(200);

128 $pageView->assertDontSee($script, false);

129 $pageView->assertSee('abc123abc123');

130 }

131

132 public function test_more_complex_content_script_escaping_scenarios()

133 {

134 $checks = [

135 "<p>Some script</p><script>alert('cat')</script>",

136 "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",

137 "<p>Some script<script>alert('cat')</script></p>",

138 "<p>Some script <div><script>alert('cat')</script></div></p>",

139 "<p>Some script <script><div>alert('cat')</script></div></p>",

140 "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",

141 ];

142

143 $this->asEditor();

144 $page = Page::query()->first();

145

146 foreach ($checks as $check) {

147 $page->html = $check;

148 $page->save();

149

150 $pageView = $this->get($page->getUrl());

151 $pageView->assertStatus(200);

152 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<script>');

153 $this->withHtml($pageView)->assertElementNotContains('.page-content', '</script>');

154 }

155 }

156

157 public function test_js_and_base64_src_urls_are_removed()

158 {

159 $checks = [

160 '<iframe src="javascript:alert(document.cookie)"></iframe>',

161 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

162 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

163 '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',

164 '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

165 '<iframe src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

166 '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

167 '<img src="javascript:alert(document.cookie)"/>',

168 '<img src="JavAScRipT:alert(document.cookie)"/>',

169 '<img src="JavAScRipT:alert(document.cookie)"/>',

170 '<img SRC=" javascript: alert(document.cookie)"/>',

171 '<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

172 '<img src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

173 '<img src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

174 '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>',

175 '<iframe SRCdoc="<script>window.alert(document.cookie)</script>"></iframe>',

176 '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',

177 ];

178

179 $this->asEditor();

180 $page = Page::query()->first();

181

182 foreach ($checks as $check) {

183 $page->html = $check;

184 $page->save();

185

186 $pageView = $this->get($page->getUrl());

187 $pageView->assertStatus(200);

188 $html = $this->withHtml($pageView);

189 $html->assertElementNotContains('.page-content', '<iframe>');

190 $html->assertElementNotContains('.page-content', '<img');

191 $html->assertElementNotContains('.page-content', '</iframe>');

192 $html->assertElementNotContains('.page-content', 'src=');

193 $html->assertElementNotContains('.page-content', 'javascript:');

194 $html->assertElementNotContains('.page-content', 'data:');

195 $html->assertElementNotContains('.page-content', 'base64');

196 }

197 }

198

199 public function test_javascript_uri_links_are_removed()

200 {

201 $checks = [

202 '<a id="xss" href="javascript:alert(document.cookie)>Click me</a>',

203 '<a id="xss" href="javascript: alert(document.cookie)>Click me</a>',

204 '<a id="xss" href="JaVaScRiPt: alert(document.cookie)>Click me</a>',

205 '<a id="xss" href=" JaVaScRiPt: alert(document.cookie)>Click me</a>',

206 ];

207

208 $this->asEditor();

209 $page = Page::query()->first();

210

211 foreach ($checks as $check) {

212 $page->html = $check;

213 $page->save();

214

215 $pageView = $this->get($page->getUrl());

216 $pageView->assertStatus(200);

217 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<a id="xss"');

218 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'href=javascript:');

219 }

220 }

221

222 public function test_form_actions_with_javascript_are_removed()

223 {

224 $checks = [

225 '<form><input id="xss" type=submit formaction=javascript:alert(document.domain) value=Submit><input></form>',

226 '<form ><button id="xss" formaction="JaVaScRiPt:alert(document.domain)">Click me</button></form>',

227 '<form ><button id="xss" formaction=javascript:alert(document.domain)>Click me</button></form>',

228 '<form id="xss" action=javascript:alert(document.domain)><input type=submit value=Submit></form>',

229 '<form id="xss" action="JaVaScRiPt:alert(document.domain)"><input type=submit value=Submit></form>',

230 ];

231

232 $this->asEditor();

233 $page = Page::query()->first();

234

235 foreach ($checks as $check) {

236 $page->html = $check;

237 $page->save();

238

239 $pageView = $this->get($page->getUrl());

240 $pageView->assertStatus(200);

241 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<button id="xss"');

242 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<input id="xss"');

243 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<form id="xss"');

244 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'action=javascript:');

245 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'formaction=javascript:');

246 }

247 }

248

249 public function test_metadata_redirects_are_removed()

250 {

251 $checks = [

252 '<meta http-equiv="refresh" content="0; url=//external_url">',

253 '<meta http-equiv="refresh" ConTeNt="0; url=//external_url">',

254 '<meta http-equiv="refresh" content="0; UrL=//external_url">',

255 ];

256

257 $this->asEditor();

258 $page = Page::query()->first();

259

260 foreach ($checks as $check) {

261 $page->html = $check;

262 $page->save();

263

264 $pageView = $this->get($page->getUrl());

265 $pageView->assertStatus(200);

266 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<meta>');

267 $this->withHtml($pageView)->assertElementNotContains('.page-content', '</meta>');

268 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'content=');

269 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'external_url');

270 }

271 }

272

273 public function test_page_inline_on_attributes_removed_by_default()

274 {

275 $this->asEditor();

276 $page = Page::query()->first();

277 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

278 $page->html = "escape {$script}";

279 $page->save();

280

281 $pageView = $this->get($page->getUrl());

282 $pageView->assertStatus(200);

283 $pageView->assertDontSee($script, false);

284 $pageView->assertSee('<p>Hello</p>', false);

285 }

286

287 public function test_more_complex_inline_on_attributes_escaping_scenarios()

288 {

289 $checks = [

290 '<p onclick="console.log(\'test\')">Hello</p>',

291 '<p OnCliCk="console.log(\'test\')">Hello</p>',

292 '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',

293 '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',

294 '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',

295 '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',

296 '<a a="<img src=1 onerror=\'alert(1)\'> ',

297 '\<a onclick="alert(document.cookie)"\>xss link\</a\>',

298 ];

299

300 $this->asEditor();

301 $page = Page::query()->first();

302

303 foreach ($checks as $check) {

304 $page->html = $check;

305 $page->save();

306

307 $pageView = $this->get($page->getUrl());

308 $pageView->assertStatus(200);

309 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'onclick');

310 }

311 }

312

313 public function test_page_content_scripts_show_when_configured()

314 {

315 $this->asEditor();

316 $page = Page::query()->first();

317 config()->push('app.allow_content_scripts', 'true');

318

319 $script = 'abc123<script>console.log("hello-test")</script>abc123';

320 $page->html = "no escape {$script}";

321 $page->save();

322

323 $pageView = $this->get($page->getUrl());

324 $pageView->assertSee($script, false);

325 $pageView->assertDontSee('abc123abc123');

326 }

327

328 public function test_svg_xlink_hrefs_are_removed()

329 {

330 $checks = [

331 '<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',

332 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>',

333 ];

334

335 $this->asEditor();

336 $page = Page::query()->first();

337

338 foreach ($checks as $check) {

339 $page->html = $check;

340 $page->save();

341

342 $pageView = $this->get($page->getUrl());

343 $pageView->assertStatus(200);

344 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'alert');

345 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'xlink:href');

346 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'application/xml');

347 }

348 }

349

350 public function test_page_inline_on_attributes_show_if_configured()

351 {

352 $this->asEditor();

353 $page = Page::query()->first();

354 config()->push('app.allow_content_scripts', 'true');

355

356 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

357 $page->html = "escape {$script}";

358 $page->save();

359

360 $pageView = $this->get($page->getUrl());

361 $pageView->assertSee($script, false);

362 $pageView->assertDontSee('<p>Hello</p>', false);

363 }

364

365 public function test_duplicate_ids_does_not_break_page_render()

366 {

367 $this->asEditor();

368 $pageA = Page::query()->first();

369 $pageB = Page::query()->where('id', '!=', $pageA->id)->first();

370

371 $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';

372 $pageA->html = $content;

373 $pageA->save();

374

375 $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@' . $pageA->id . '#test}}</p>';

376 $pageB->save();

377

378 $pageView = $this->get($pageB->getUrl());

379 $pageView->assertSuccessful();

380 }

381

382 public function test_duplicate_ids_fixed_on_page_save()

383 {

384 $this->asEditor();

385 $page = Page::query()->first();

386

387 $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';

388 $pageSave = $this->put($page->getUrl(), [

389 'name' => $page->name,

390 'html' => $content,

391 'summary' => '',

392 ]);

393 $pageSave->assertRedirect();

394

395 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

396 $this->assertEquals(substr_count($updatedPage->html, 'bkmrk-test"'), 1);

397 }

398

399 public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()

400 {

401 $this->asEditor();

402 $page = Page::query()->first();

403

404 $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';

405 $this->put($page->getUrl(), [

406 'name' => $page->name,

407 'html' => $content,

408 'summary' => '',

409 ]);

410

411 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

412 $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);

413 $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);

414 }

415

416 public function test_get_page_nav_sets_correct_properties()

417 {

418 $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';

419 $pageContent = new PageContent(new Page(['html' => $content]));

420 $navMap = $pageContent->getNavigation($content);

421

422 $this->assertCount(3, $navMap);

423 $this->assertArrayMapIncludes([

424 'nodeName' => 'h1',

425 'link' => '#testa',

426 'text' => 'Hello',

427 'level' => 1,

428 ], $navMap[0]);

429 $this->assertArrayMapIncludes([

430 'nodeName' => 'h2',

431 'link' => '#testb',

432 'text' => 'There',

433 'level' => 2,

434 ], $navMap[1]);

435 $this->assertArrayMapIncludes([

436 'nodeName' => 'h3',

437 'link' => '#testc',

438 'text' => 'Donkey',

439 'level' => 3,

440 ], $navMap[2]);

441 }

442

443 public function test_get_page_nav_does_not_show_empty_titles()

444 {

445 $content = '<h1 id="testa">Hello</h1><h2 id="testb"> </h2><h3 id="testc"></h3>';

446 $pageContent = new PageContent(new Page(['html' => $content]));

447 $navMap = $pageContent->getNavigation($content);

448

449 $this->assertCount(1, $navMap);

450 $this->assertArrayMapIncludes([

451 'nodeName' => 'h1',

452 'link' => '#testa',

453 'text' => 'Hello',

454 ], $navMap[0]);

455 }

456

457 public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()

458 {

459 $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';

460 $pageContent = new PageContent(new Page(['html' => $content]));

461 $navMap = $pageContent->getNavigation($content);

462

463 $this->assertCount(3, $navMap);

464 $this->assertArrayMapIncludes([

465 'nodeName' => 'h4',

466 'level' => 1,

467 ], $navMap[0]);

468 $this->assertArrayMapIncludes([

469 'nodeName' => 'h5',

470 'level' => 2,

471 ], $navMap[1]);

472 $this->assertArrayMapIncludes([

473 'nodeName' => 'h6',

474 'level' => 3,

475 ], $navMap[2]);

476 }

477

478 public function test_page_text_decodes_html_entities()

479 {

480 $page = Page::query()->first();

481

482 $this->actingAs($this->getAdmin())

483 ->put($page->getUrl(''), [

484 'name' => 'Testing',

485 'html' => '<p>"Hello & welcome"</p>',

486 ]);

487

488 $page->refresh();

489 $this->assertEquals('"Hello & welcome"', $page->text);

490 }

491

492 public function test_page_markdown_table_rendering()

493 {

494 $this->asEditor();

495 $page = Page::query()->first();

496

497 $content = '| Syntax | Description |

498 | ----------- | ----------- |

499 | Header | Title |

500 | Paragraph | Text |';

501 $this->put($page->getUrl(), [

502 'name' => $page->name, 'markdown' => $content,

503 'html' => '', 'summary' => '',

504 ]);

505

506 $page->refresh();

507 $this->assertStringContainsString('</tbody>', $page->html);

508

509 $pageView = $this->get($page->getUrl());

510 $this->withHtml($pageView)->assertElementExists('.page-content table tbody td');

511 }

512

513 public function test_page_markdown_task_list_rendering()

514 {

515 $this->asEditor();

516 $page = Page::query()->first();

517

518 $content = '- [ ] Item a

519 - [x] Item b';

520 $this->put($page->getUrl(), [

521 'name' => $page->name, 'markdown' => $content,

522 'html' => '', 'summary' => '',

523 ]);

524

525 $page->refresh();

526 $this->assertStringContainsString('input', $page->html);

527 $this->assertStringContainsString('type="checkbox"', $page->html);

528

529 $pageView = $this->get($page->getUrl());

530 $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox]');

531 $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox][checked]');

532 }

533

534 public function test_page_markdown_strikethrough_rendering()

535 {

536 $this->asEditor();

537 $page = Page::query()->first();

538

539 $content = '~~some crossed out text~~';

540 $this->put($page->getUrl(), [

541 'name' => $page->name, 'markdown' => $content,

542 'html' => '', 'summary' => '',

543 ]);

544

545 $page->refresh();

546 $this->assertStringMatchesFormat('%A<s%A>some crossed out text</s>%A', $page->html);

547

548 $pageView = $this->get($page->getUrl());

549 $this->withHtml($pageView)->assertElementExists('.page-content p > s');

550 }

551

552 public function test_page_markdown_single_html_comment_saving()

553 {

554 $this->asEditor();

555 $page = Page::query()->first();

556

557 $content = '';

558 $this->put($page->getUrl(), [

559 'name' => $page->name, 'markdown' => $content,

560 'html' => '', 'summary' => '',

561 ]);

562

563 $page->refresh();

564 $this->assertStringMatchesFormat($content, $page->html);

565

566 $pageView = $this->get($page->getUrl());

567 $pageView->assertStatus(200);

568 $pageView->assertSee($content, false);

569 }

570

571 public function test_base64_images_get_extracted_from_page_content()

572 {

573 $this->asEditor();

574 $page = Page::query()->first();

575

576 $this->put($page->getUrl(), [

577 'name' => $page->name, 'summary' => '',

578 'html' => '<p>test<img src="data:image/jpeg;base64,' . $this->base64Jpeg . '"/></p>',

579 ]);

580

581 $page->refresh();

582 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.jpeg">%A</p>%A', $page->html);

583

584 $matches = [];

585 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

586 $imagePath = $matches[1];

587 $imageFile = public_path($imagePath);

588 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

589

590 $this->deleteImage($imagePath);

591 }

592

593 public function test_base64_images_get_extracted_when_containing_whitespace()

594 {

595 $this->asEditor();

596 $page = Page::query()->first();

597

598 $base64PngWithWhitespace = "iVBORw0KGg\noAAAANSUhE\tUgAAAAEAAAA BCA YAAAAfFcSJAAA\n\t ACklEQVR4nGMAAQAABQAB";

599 $base64PngWithoutWhitespace = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQAB';

600 $this->put($page->getUrl(), [

601 'name' => $page->name, 'summary' => '',

602 'html' => '<p>test<img src="data:image/png;base64,' . $base64PngWithWhitespace . '"/></p>',

603 ]);

604

605 $page->refresh();

606 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.png">%A</p>%A', $page->html);

607

608 $matches = [];

609 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

610 $imagePath = $matches[1];

611 $imageFile = public_path($imagePath);

612 $this->assertEquals(base64_decode($base64PngWithoutWhitespace), file_get_contents($imageFile));

613

614 $this->deleteImage($imagePath);

615 }

616

617 public function test_base64_images_within_html_blanked_if_not_supported_extension_for_extract()

618 {

619 // Relevant to https://github.com/BookStackApp/BookStack/issues/3010 and other cases

620 $extensions = [

621 'jiff', 'pngr', 'png ', ' png', '.png', 'png.', 'p.ng', ',png',

622 'data:image/png', ',data:image/png',

623 ];

624

625 foreach ($extensions as $extension) {

626 $this->asEditor();

627 $page = Page::query()->first();

628

629 $this->put($page->getUrl(), [

630 'name' => $page->name, 'summary' => '',

631 'html' => '<p>test<img src="data:image/' . $extension . ';base64,' . $this->base64Jpeg . '"/></p>',

632 ]);

633

634 $page->refresh();

635 $this->assertStringContainsString('<img src=""', $page->html);

636 }

637 }

638

639 public function test_base64_images_get_extracted_from_markdown_page_content()

640 {

641 $this->asEditor();

642 $page = Page::query()->first();

643

644 $this->put($page->getUrl(), [

645 'name' => $page->name, 'summary' => '',

646 'markdown' => 'test ![test](data:image/jpeg;base64,' . $this->base64Jpeg . ')',

647 ]);

648

649 $page->refresh();

650 $this->assertStringMatchesFormat('%A<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

651

652 $matches = [];

653 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

654 $imagePath = $matches[1];

655 $imageFile = public_path($imagePath);

656 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

657

658 $this->deleteImage($imagePath);

659 }

660

661 public function test_markdown_base64_extract_not_limited_by_pcre_limits()

662 {

663 $pcreBacktrackLimit = ini_get('pcre.backtrack_limit');

664 $pcreRecursionLimit = ini_get('pcre.recursion_limit');

665

666 $this->asEditor();

667 $page = Page::query()->first();

668

669 ini_set('pcre.backtrack_limit', '500');

670 ini_set('pcre.recursion_limit', '500');

671

672 $content = str_repeat('a', 5000);

673 $base64Content = base64_encode($content);

674

675 $this->put($page->getUrl(), [

676 'name' => $page->name, 'summary' => '',

677 'markdown' => 'test ![test](data:image/jpeg;base64,' . $base64Content . ') ![test](data:image/jpeg;base64,' . $base64Content . ')',

678 ]);

679

680 $page->refresh();

681 $this->assertStringMatchesFormat('<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test"> <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

682

683 $matches = [];

684 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

685 $imagePath = $matches[1];

686 $imageFile = public_path($imagePath);

687 $this->assertEquals($content, file_get_contents($imageFile));

688

689 $this->deleteImage($imagePath);

690 ini_set('pcre.backtrack_limit', $pcreBacktrackLimit);

691 ini_set('pcre.recursion_limit', $pcreRecursionLimit);

692 }

693