BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

1 <?php

2

3 namespace Tests\Entity;

4

5 use BookStack\Entities\Models\Page;

6 use BookStack\Entities\Tools\PageContent;

7 use Tests\TestCase;

8 use Tests\Uploads\UsesImages;

9

10 class PageContentTest extends TestCase

11 {

12 use UsesImages;

13

14 protected $base64Jpeg = '/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=';

15

16 public function test_page_includes()

17 {

18 $page = Page::query()->first();

19 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

20

21 $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";

22 $secondPage->save();

23

24 $this->asEditor();

25

26 $pageContent = $this->get($page->getUrl());

27 $pageContent->assertDontSee('Hello, This is a test');

28

29 $originalHtml = $page->html;

30 $page->html .= "{{@{$secondPage->id}}}";

31 $page->save();

32

33 $pageContent = $this->get($page->getUrl());

34 $pageContent->assertSee('Hello, This is a test');

35 $pageContent->assertSee('This is a second block of content');

36

37 $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";

38 $page->save();

39

40 $pageContent = $this->get($page->getUrl());

41 $pageContent->assertDontSee('Hello, This is a test');

42 $pageContent->assertSee('Well This is a second block of content');

43 }

44

45 public function test_saving_page_with_includes()

46 {

47 $page = Page::query()->first();

48 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

49

50 $this->asEditor();

51 $includeTag = '{{@' . $secondPage->id . '}}';

52 $page->html = '<p>' . $includeTag . '</p>';

53

54 $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);

55

56 $resp->assertStatus(302);

57

58 $page = Page::find($page->id);

59 $this->assertStringContainsString($includeTag, $page->html);

60 $this->assertEquals('', $page->text);

61 }

62

63 public function test_page_includes_do_not_break_tables()

64 {

65 /** @var Page $page */

66 $page = Page::query()->first();

67 /** @var Page $secondPage */

68 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

69

70 $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';

71 $secondPage->html = $content;

72 $secondPage->save();

73

74 $page->html = "{{@{$secondPage->id}#table}}";

75 $page->save();

76

77 $pageResp = $this->asEditor()->get($page->getUrl());

78 $pageResp->assertSee($content, false);

79 }

80

81 public function test_page_includes_do_not_break_code()

82 {

83 /** @var Page $page */

84 $page = Page::query()->first();

85 /** @var Page $secondPage */

86 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

87

88 $content = '<pre id="bkmrk-code"><code>var cat = null;</code></pre>';

89 $secondPage->html = $content;

90 $secondPage->save();

91

92 $page->html = "{{@{$secondPage->id}#bkmrk-code}}";

93 $page->save();

94

95 $pageResp = $this->asEditor()->get($page->getUrl());

96 $pageResp->assertSee($content, false);

97 }

98

99 public function test_page_includes_rendered_on_book_export()

100 {

101 $page = Page::query()->first();

102 $secondPage = Page::query()

103 ->where('book_id', '!=', $page->book_id)

104 ->first();

105

106 $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';

107 $secondPage->html = $content;

108 $secondPage->save();

109

110 $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";

111 $page->save();

112

113 $this->asEditor();

114 $htmlContent = $this->get($page->book->getUrl('/export/html'));

115 $htmlContent->assertSee('my cat is awesome and scratchy');

116 }

117

118 public function test_page_content_scripts_removed_by_default()

119 {

120 $this->asEditor();

121 $page = Page::query()->first();

122 $script = 'abc123<script>console.log("hello-test")</script>abc123';

123 $page->html = "escape {$script}";

124 $page->save();

125

126 $pageView = $this->get($page->getUrl());

127 $pageView->assertStatus(200);

128 $pageView->assertDontSee($script, false);

129 $pageView->assertSee('abc123abc123');

130 }

131

132 public function test_more_complex_content_script_escaping_scenarios()

133 {

134 $checks = [

135 "<p>Some script</p><script>alert('cat')</script>",

136 "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",

137 "<p>Some script<script>alert('cat')</script></p>",

138 "<p>Some script <div><script>alert('cat')</script></div></p>",

139 "<p>Some script <script><div>alert('cat')</script></div></p>",

140 "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",

141 ];

142

143 $this->asEditor();

144 $page = Page::query()->first();

145

146 foreach ($checks as $check) {

147 $page->html = $check;

148 $page->save();

149

150 $pageView = $this->get($page->getUrl());

151 $pageView->assertStatus(200);

152 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<script>');

153 $this->withHtml($pageView)->assertElementNotContains('.page-content', '</script>');

154 }

155 }

156

157 public function test_js_and_base64_src_urls_are_removed()

158 {

159 $checks = [

160 '<iframe src="javascript:alert(document.cookie)"></iframe>',

161 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

162 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

163 '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',

164 '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

165 '<iframe src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

166 '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

167 '<img src="javascript:alert(document.cookie)"/>',

168 '<img src="JavAScRipT:alert(document.cookie)"/>',

169 '<img src="JavAScRipT:alert(document.cookie)"/>',

170 '<img SRC=" javascript: alert(document.cookie)"/>',

171 '<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

172 '<img src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

173 '<img src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

174 '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>',

175 '<iframe SRCdoc="<script>window.alert(document.cookie)</script>"></iframe>',

176 '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',

177 ];

178

179 $this->asEditor();

180 $page = Page::query()->first();

181

182 foreach ($checks as $check) {

183 $page->html = $check;

184 $page->save();

185

186 $pageView = $this->get($page->getUrl());

187 $pageView->assertStatus(200);

188 $html = $this->withHtml($pageView);

189 $html->assertElementNotContains('.page-content', '<iframe>');

190 $html->assertElementNotContains('.page-content', '<img');

191 $html->assertElementNotContains('.page-content', '</iframe>');

192 $html->assertElementNotContains('.page-content', 'src=');

193 $html->assertElementNotContains('.page-content', 'javascript:');

194 $html->assertElementNotContains('.page-content', 'data:');

195 $html->assertElementNotContains('.page-content', 'base64');

196 }

197 }

198

199 public function test_javascript_uri_links_are_removed()

200 {

201 $checks = [

202 '<a id="xss" href="javascript:alert(document.cookie)>Click me</a>',

203 '<a id="xss" href="javascript: alert(document.cookie)>Click me</a>',

204 '<a id="xss" href="JaVaScRiPt: alert(document.cookie)>Click me</a>',

205 '<a id="xss" href=" JaVaScRiPt: alert(document.cookie)>Click me</a>',

206 ];

207

208 $this->asEditor();

209 $page = Page::query()->first();

210

211 foreach ($checks as $check) {

212 $page->html = $check;

213 $page->save();

214

215 $pageView = $this->get($page->getUrl());

216 $pageView->assertStatus(200);

217 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<a id="xss"');

218 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'href=javascript:');

219 }

220 }

221

222 public function test_form_actions_with_javascript_are_removed()

223 {

224 $checks = [

225 '<form><input id="xss" type=submit formaction=javascript:alert(document.domain) value=Submit><input></form>',

226 '<form ><button id="xss" formaction="JaVaScRiPt:alert(document.domain)">Click me</button></form>',

227 '<form ><button id="xss" formaction=javascript:alert(document.domain)>Click me</button></form>',

228 '<form id="xss" action=javascript:alert(document.domain)><input type=submit value=Submit></form>',

229 '<form id="xss" action="JaVaScRiPt:alert(document.domain)"><input type=submit value=Submit></form>',

230 ];

231

232 $this->asEditor();

233 $page = Page::query()->first();

234

235 foreach ($checks as $check) {

236 $page->html = $check;

237 $page->save();

238

239 $pageView = $this->get($page->getUrl());

240 $pageView->assertStatus(200);

241 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<button id="xss"');

242 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<input id="xss"');

243 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<form id="xss"');

244 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'action=javascript:');

245 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'formaction=javascript:');

246 }

247 }

248

249 public function test_metadata_redirects_are_removed()

250 {

251 $checks = [

252 '<meta http-equiv="refresh" content="0; url=//external_url">',

253 '<meta http-equiv="refresh" ConTeNt="0; url=//external_url">',

254 '<meta http-equiv="refresh" content="0; UrL=//external_url">',

255 ];

256

257 $this->asEditor();

258 $page = Page::query()->first();

259

260 foreach ($checks as $check) {

261 $page->html = $check;

262 $page->save();

263

264 $pageView = $this->get($page->getUrl());

265 $pageView->assertStatus(200);

266 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<meta>');

267 $this->withHtml($pageView)->assertElementNotContains('.page-content', '</meta>');

268 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'content=');

269 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'external_url');

270 }

271 }

272

273 public function test_page_inline_on_attributes_removed_by_default()

274 {

275 $this->asEditor();

276 $page = Page::query()->first();

277 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

278 $page->html = "escape {$script}";

279 $page->save();

280

281 $pageView = $this->get($page->getUrl());

282 $pageView->assertStatus(200);

283 $pageView->assertDontSee($script, false);

284 $pageView->assertSee('<p>Hello</p>', false);

285 }

286

287 public function test_more_complex_inline_on_attributes_escaping_scenarios()

288 {

289 $checks = [

290 '<p onclick="console.log(\'test\')">Hello</p>',

291 '<p OnCliCk="console.log(\'test\')">Hello</p>',

292 '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',

293 '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',

294 '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',

295 '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',

296 '<a a="<img src=1 onerror=\'alert(1)\'> ',

297 '\<a onclick="alert(document.cookie)"\>xss link\</a\>',

298 ];

299

300 $this->asEditor();

301 $page = Page::query()->first();

302

303 foreach ($checks as $check) {

304 $page->html = $check;

305 $page->save();

306

307 $pageView = $this->get($page->getUrl());

308 $pageView->assertStatus(200);

309 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'onclick');

310 }

311 }

312

313 public function test_page_content_scripts_show_when_configured()

314 {

315 $this->asEditor();

316 $page = Page::query()->first();

317 config()->push('app.allow_content_scripts', 'true');

318

319 $script = 'abc123<script>console.log("hello-test")</script>abc123';

320 $page->html = "no escape {$script}";

321 $page->save();

322

323 $pageView = $this->get($page->getUrl());

324 $pageView->assertSee($script, false);

325 $pageView->assertDontSee('abc123abc123');

326 }

327

328 public function test_svg_script_usage_is_removed()

329 {

330 $checks = [

331 '<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',

332 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>',

333 '<svg><animate href=#xss attributeName=href values=javascript:alert(1) /></svg>',

334 '<svg><animate href="#xss" attributeName="href" values="a;javascript:alert(1)" /></svg>',

335 '<svg><animate href="#xss" attributeName="href" values="a;data:alert(1)" /></svg>',

336 ];

337

338 $this->asEditor();

339 $page = Page::query()->first();

340

341 foreach ($checks as $check) {

342 $page->html = $check;

343 $page->save();

344

345 $pageView = $this->get($page->getUrl());

346 $pageView->assertStatus(200);

347 $html = $this->withHtml($pageView);

348 $html->assertElementNotContains('.page-content', 'alert');

349 $html->assertElementNotContains('.page-content', 'xlink:href');

350 $html->assertElementNotContains('.page-content', 'application/xml');

351 $html->assertElementNotContains('.page-content', 'javascript');

352 }

353 }

354

355 public function test_page_inline_on_attributes_show_if_configured()

356 {

357 $this->asEditor();

358 $page = Page::query()->first();

359 config()->push('app.allow_content_scripts', 'true');

360

361 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

362 $page->html = "escape {$script}";

363 $page->save();

364

365 $pageView = $this->get($page->getUrl());

366 $pageView->assertSee($script, false);

367 $pageView->assertDontSee('<p>Hello</p>', false);

368 }

369

370 public function test_duplicate_ids_does_not_break_page_render()

371 {

372 $this->asEditor();

373 $pageA = Page::query()->first();

374 $pageB = Page::query()->where('id', '!=', $pageA->id)->first();

375

376 $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';

377 $pageA->html = $content;

378 $pageA->save();

379

380 $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@' . $pageA->id . '#test}}</p>';

381 $pageB->save();

382

383 $pageView = $this->get($pageB->getUrl());

384 $pageView->assertSuccessful();

385 }

386

387 public function test_duplicate_ids_fixed_on_page_save()

388 {

389 $this->asEditor();

390 $page = Page::query()->first();

391

392 $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';

393 $pageSave = $this->put($page->getUrl(), [

394 'name' => $page->name,

395 'html' => $content,

396 'summary' => '',

397 ]);

398 $pageSave->assertRedirect();

399

400 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

401 $this->assertEquals(substr_count($updatedPage->html, 'bkmrk-test"'), 1);

402 }

403

404 public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()

405 {

406 $this->asEditor();

407 $page = Page::query()->first();

408

409 $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';

410 $this->put($page->getUrl(), [

411 'name' => $page->name,

412 'html' => $content,

413 'summary' => '',

414 ]);

415

416 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

417 $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);

418 $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);

419 }

420

421 public function test_get_page_nav_sets_correct_properties()

422 {

423 $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';

424 $pageContent = new PageContent(new Page(['html' => $content]));

425 $navMap = $pageContent->getNavigation($content);

426

427 $this->assertCount(3, $navMap);

428 $this->assertArrayMapIncludes([

429 'nodeName' => 'h1',

430 'link' => '#testa',

431 'text' => 'Hello',

432 'level' => 1,

433 ], $navMap[0]);

434 $this->assertArrayMapIncludes([

435 'nodeName' => 'h2',

436 'link' => '#testb',

437 'text' => 'There',

438 'level' => 2,

439 ], $navMap[1]);

440 $this->assertArrayMapIncludes([

441 'nodeName' => 'h3',

442 'link' => '#testc',

443 'text' => 'Donkey',

444 'level' => 3,

445 ], $navMap[2]);

446 }

447

448 public function test_get_page_nav_does_not_show_empty_titles()

449 {

450 $content = '<h1 id="testa">Hello</h1><h2 id="testb"> </h2><h3 id="testc"></h3>';

451 $pageContent = new PageContent(new Page(['html' => $content]));

452 $navMap = $pageContent->getNavigation($content);

453

454 $this->assertCount(1, $navMap);

455 $this->assertArrayMapIncludes([

456 'nodeName' => 'h1',

457 'link' => '#testa',

458 'text' => 'Hello',

459 ], $navMap[0]);

460 }

461

462 public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()

463 {

464 $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';

465 $pageContent = new PageContent(new Page(['html' => $content]));

466 $navMap = $pageContent->getNavigation($content);

467

468 $this->assertCount(3, $navMap);

469 $this->assertArrayMapIncludes([

470 'nodeName' => 'h4',

471 'level' => 1,

472 ], $navMap[0]);

473 $this->assertArrayMapIncludes([

474 'nodeName' => 'h5',

475 'level' => 2,

476 ], $navMap[1]);

477 $this->assertArrayMapIncludes([

478 'nodeName' => 'h6',

479 'level' => 3,

480 ], $navMap[2]);

481 }

482

483 public function test_page_text_decodes_html_entities()

484 {

485 $page = Page::query()->first();

486

487 $this->actingAs($this->getAdmin())

488 ->put($page->getUrl(''), [

489 'name' => 'Testing',

490 'html' => '<p>"Hello & welcome"</p>',

491 ]);

492

493 $page->refresh();

494 $this->assertEquals('"Hello & welcome"', $page->text);

495 }

496

497 public function test_page_markdown_table_rendering()

498 {

499 $this->asEditor();

500 $page = Page::query()->first();

501

502 $content = '| Syntax | Description |

503 | ----------- | ----------- |

504 | Header | Title |

505 | Paragraph | Text |';

506 $this->put($page->getUrl(), [

507 'name' => $page->name, 'markdown' => $content,

508 'html' => '', 'summary' => '',

509 ]);

510

511 $page->refresh();

512 $this->assertStringContainsString('</tbody>', $page->html);

513

514 $pageView = $this->get($page->getUrl());

515 $this->withHtml($pageView)->assertElementExists('.page-content table tbody td');

516 }

517

518 public function test_page_markdown_task_list_rendering()

519 {

520 $this->asEditor();

521 $page = Page::query()->first();

522

523 $content = '- [ ] Item a

524 - [x] Item b';

525 $this->put($page->getUrl(), [

526 'name' => $page->name, 'markdown' => $content,

527 'html' => '', 'summary' => '',

528 ]);

529

530 $page->refresh();

531 $this->assertStringContainsString('input', $page->html);

532 $this->assertStringContainsString('type="checkbox"', $page->html);

533

534 $pageView = $this->get($page->getUrl());

535 $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox]');

536 $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox][checked]');

537 }

538

539 public function test_page_markdown_strikethrough_rendering()

540 {

541 $this->asEditor();

542 $page = Page::query()->first();

543

544 $content = '~~some crossed out text~~';

545 $this->put($page->getUrl(), [

546 'name' => $page->name, 'markdown' => $content,

547 'html' => '', 'summary' => '',

548 ]);

549

550 $page->refresh();

551 $this->assertStringMatchesFormat('%A<s%A>some crossed out text</s>%A', $page->html);

552

553 $pageView = $this->get($page->getUrl());

554 $this->withHtml($pageView)->assertElementExists('.page-content p > s');

555 }

556

557 public function test_page_markdown_single_html_comment_saving()

558 {

559 $this->asEditor();

560 $page = Page::query()->first();

561

562 $content = '';

563 $this->put($page->getUrl(), [

564 'name' => $page->name, 'markdown' => $content,

565 'html' => '', 'summary' => '',

566 ]);

567

568 $page->refresh();

569 $this->assertStringMatchesFormat($content, $page->html);

570

571 $pageView = $this->get($page->getUrl());

572 $pageView->assertStatus(200);

573 $pageView->assertSee($content, false);

574 }

575

576 public function test_base64_images_get_extracted_from_page_content()

577 {

578 $this->asEditor();

579 $page = Page::query()->first();

580

581 $this->put($page->getUrl(), [

582 'name' => $page->name, 'summary' => '',

583 'html' => '<p>test<img src="data:image/jpeg;base64,' . $this->base64Jpeg . '"/></p>',

584 ]);

585

586 $page->refresh();

587 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.jpeg">%A</p>%A', $page->html);

588

589 $matches = [];

590 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

591 $imagePath = $matches[1];

592 $imageFile = public_path($imagePath);

593 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

594

595 $this->deleteImage($imagePath);

596 }

597

598 public function test_base64_images_get_extracted_when_containing_whitespace()

599 {

600 $this->asEditor();

601 $page = Page::query()->first();

602

603 $base64PngWithWhitespace = "iVBORw0KGg\noAAAANSUhE\tUgAAAAEAAAA BCA YAAAAfFcSJAAA\n\t ACklEQVR4nGMAAQAABQAB";

604 $base64PngWithoutWhitespace = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQAB';

605 $this->put($page->getUrl(), [

606 'name' => $page->name, 'summary' => '',

607 'html' => '<p>test<img src="data:image/png;base64,' . $base64PngWithWhitespace . '"/></p>',

608 ]);

609

610 $page->refresh();

611 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.png">%A</p>%A', $page->html);

612

613 $matches = [];

614 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

615 $imagePath = $matches[1];

616 $imageFile = public_path($imagePath);

617 $this->assertEquals(base64_decode($base64PngWithoutWhitespace), file_get_contents($imageFile));

618

619 $this->deleteImage($imagePath);

620 }

621

622 public function test_base64_images_within_html_blanked_if_not_supported_extension_for_extract()

623 {

624 // Relevant to https://github.com/BookStackApp/BookStack/issues/3010 and other cases

625 $extensions = [

626 'jiff', 'pngr', 'png ', ' png', '.png', 'png.', 'p.ng', ',png',

627 'data:image/png', ',data:image/png',

628 ];

629

630 foreach ($extensions as $extension) {

631 $this->asEditor();

632 $page = Page::query()->first();

633

634 $this->put($page->getUrl(), [

635 'name' => $page->name, 'summary' => '',

636 'html' => '<p>test<img src="data:image/' . $extension . ';base64,' . $this->base64Jpeg . '"/></p>',

637 ]);

638

639 $page->refresh();

640 $this->assertStringContainsString('<img src=""', $page->html);

641 }

642 }

643

644 public function test_base64_images_get_extracted_from_markdown_page_content()

645 {

646 $this->asEditor();

647 $page = Page::query()->first();

648

649 $this->put($page->getUrl(), [

650 'name' => $page->name, 'summary' => '',

651 'markdown' => 'test ![test](data:image/jpeg;base64,' . $this->base64Jpeg . ')',

652 ]);

653

654 $page->refresh();

655 $this->assertStringMatchesFormat('%A<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

656

657 $matches = [];

658 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

659 $imagePath = $matches[1];

660 $imageFile = public_path($imagePath);

661 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

662

663 $this->deleteImage($imagePath);

664 }

665

666 public function test_markdown_base64_extract_not_limited_by_pcre_limits()

667 {

668 $pcreBacktrackLimit = ini_get('pcre.backtrack_limit');

669 $pcreRecursionLimit = ini_get('pcre.recursion_limit');

670

671 $this->asEditor();

672 $page = Page::query()->first();

673

674 ini_set('pcre.backtrack_limit', '500');

675 ini_set('pcre.recursion_limit', '500');

676

677 $content = str_repeat('a', 5000);

678 $base64Content = base64_encode($content);

679

680 $this->put($page->getUrl(), [

681 'name' => $page->name, 'summary' => '',

682 'markdown' => 'test ![test](data:image/jpeg;base64,' . $base64Content . ') ![test](data:image/jpeg;base64,' . $base64Content . ')',

683 ]);

684

685 $page->refresh();

686 $this->assertStringMatchesFormat('<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test"> <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

687

688 $matches = [];

689 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

690 $imagePath = $matches[1];

691 $imageFile = public_path($imagePath);

692 $this->assertEquals($content, file_get_contents($imageFile));

693

694 $this->deleteImage($imagePath);

695 ini_set('pcre.backtrack_limit', $pcreBacktrackLimit);

696 ini_set('pcre.recursion_limit', $pcreRecursionLimit);

697 }

698