BookStack Code Mirror - bookstack/blob - tests/Entity/PageContentTest.php

1 <?php

2

3 namespace Tests\Entity;

4

5 use BookStack\Entities\Models\Page;

6 use BookStack\Entities\Tools\PageContent;

7 use Tests\TestCase;

8 use Tests\Uploads\UsesImages;

9

10 class PageContentTest extends TestCase

11 {

12 use UsesImages;

13

14 protected $base64Jpeg = '/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=';

15

16 public function test_page_includes()

17 {

18 $page = Page::query()->first();

19 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

20

21 $secondPage->html = "<p id='section1'>Hello, This is a test</p><p id='section2'>This is a second block of content</p>";

22 $secondPage->save();

23

24 $this->asEditor();

25

26 $pageContent = $this->get($page->getUrl());

27 $pageContent->assertDontSee('Hello, This is a test');

28

29 $originalHtml = $page->html;

30 $page->html .= "{{@{$secondPage->id}}}";

31 $page->save();

32

33 $pageContent = $this->get($page->getUrl());

34 $pageContent->assertSee('Hello, This is a test');

35 $pageContent->assertSee('This is a second block of content');

36

37 $page->html = $originalHtml . " Well {{@{$secondPage->id}#section2}}";

38 $page->save();

39

40 $pageContent = $this->get($page->getUrl());

41 $pageContent->assertDontSee('Hello, This is a test');

42 $pageContent->assertSee('Well This is a second block of content');

43 }

44

45 public function test_saving_page_with_includes()

46 {

47 $page = Page::query()->first();

48 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

49

50 $this->asEditor();

51 $includeTag = '{{@' . $secondPage->id . '}}';

52 $page->html = '<p>' . $includeTag . '</p>';

53

54 $resp = $this->put($page->getUrl(), ['name' => $page->name, 'html' => $page->html, 'summary' => '']);

55

56 $resp->assertStatus(302);

57

58 $page = Page::find($page->id);

59 $this->assertStringContainsString($includeTag, $page->html);

60 $this->assertEquals('', $page->text);

61 }

62

63 public function test_page_includes_do_not_break_tables()

64 {

65 /** @var Page $page */

66 $page = Page::query()->first();

67 /** @var Page $secondPage */

68 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

69

70 $content = '<table id="table"><tbody><tr><td>test</td></tr></tbody></table>';

71 $secondPage->html = $content;

72 $secondPage->save();

73

74 $page->html = "{{@{$secondPage->id}#table}}";

75 $page->save();

76

77 $pageResp = $this->asEditor()->get($page->getUrl());

78 $pageResp->assertSee($content, false);

79 }

80

81 public function test_page_includes_do_not_break_code()

82 {

83 /** @var Page $page */

84 $page = Page::query()->first();

85 /** @var Page $secondPage */

86 $secondPage = Page::query()->where('id', '!=', $page->id)->first();

87

88 $content = '<pre id="bkmrk-code"><code>var cat = null;</code></pre>';

89 $secondPage->html = $content;

90 $secondPage->save();

91

92 $page->html = "{{@{$secondPage->id}#bkmrk-code}}";

93 $page->save();

94

95 $pageResp = $this->asEditor()->get($page->getUrl());

96 $pageResp->assertSee($content, false);

97 }

98

99 public function test_page_includes_rendered_on_book_export()

100 {

101 $page = Page::query()->first();

102 $secondPage = Page::query()

103 ->where('book_id', '!=', $page->book_id)

104 ->first();

105

106 $content = '<p id="bkmrk-meow">my cat is awesome and scratchy</p>';

107 $secondPage->html = $content;

108 $secondPage->save();

109

110 $page->html = "{{@{$secondPage->id}#bkmrk-meow}}";

111 $page->save();

112

113 $this->asEditor();

114 $htmlContent = $this->get($page->book->getUrl('/export/html'));

115 $htmlContent->assertSee('my cat is awesome and scratchy');

116 }

117

118 public function test_page_content_scripts_removed_by_default()

119 {

120 $this->asEditor();

121 $page = Page::query()->first();

122 $script = 'abc123<script>console.log("hello-test")</script>abc123';

123 $page->html = "escape {$script}";

124 $page->save();

125

126 $pageView = $this->get($page->getUrl());

127 $pageView->assertStatus(200);

128 $pageView->assertDontSee($script, false);

129 $pageView->assertSee('abc123abc123');

130 }

131

132 public function test_more_complex_content_script_escaping_scenarios()

133 {

134 $checks = [

135 "<p>Some script</p><script>alert('cat')</script>",

136 "<div><div><div><div><p>Some script</p><script>alert('cat')</script></div></div></div></div>",

137 "<p>Some script<script>alert('cat')</script></p>",

138 "<p>Some script <div><script>alert('cat')</script></div></p>",

139 "<p>Some script <script><div>alert('cat')</script></div></p>",

140 "<p>Some script <script><div>alert('cat')</script><script><div>alert('cat')</script></p><script><div>alert('cat')</script>",

141 ];

142

143 $this->asEditor();

144 $page = Page::query()->first();

145

146 foreach ($checks as $check) {

147 $page->html = $check;

148 $page->save();

149

150 $pageView = $this->get($page->getUrl());

151 $pageView->assertStatus(200);

152 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<script>');

153 $this->withHtml($pageView)->assertElementNotContains('.page-content', '</script>');

154 }

155 }

156

157 public function test_js_and_base64_src_urls_are_removed()

158 {

159 $checks = [

160 '<iframe src="javascript:alert(document.cookie)"></iframe>',

161 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

162 '<iframe src="JavAScRipT:alert(document.cookie)"></iframe>',

163 '<iframe SRC=" javascript: alert(document.cookie)"></iframe>',

164 '<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

165 '<iframe src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

166 '<iframe src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg==" frameborder="0"></iframe>',

167 '<img src="javascript:alert(document.cookie)"/>',

168 '<img src="JavAScRipT:alert(document.cookie)"/>',

169 '<img src="JavAScRipT:alert(document.cookie)"/>',

170 '<img SRC=" javascript: alert(document.cookie)"/>',

171 '<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

172 '<img src="DaTa:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

173 '<img src=" data:text/html;base64,PHNjcmlwdD5hbGVydCgnaGVsbG8nKTwvc2NyaXB0Pg=="/>',

174 '<iframe srcdoc="<script>window.alert(document.cookie)</script>"></iframe>',

175 '<iframe SRCdoc="<script>window.alert(document.cookie)</script>"></iframe>',

176 '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',

177 ];

178

179 $this->asEditor();

180 $page = Page::query()->first();

181

182 foreach ($checks as $check) {

183 $page->html = $check;

184 $page->save();

185

186 $pageView = $this->get($page->getUrl());

187 $pageView->assertStatus(200);

188 $html = $this->withHtml($pageView);

189 $html->assertElementNotContains('.page-content', '<iframe>');

190 $html->assertElementNotContains('.page-content', '<img');

191 $html->assertElementNotContains('.page-content', '</iframe>');

192 $html->assertElementNotContains('.page-content', 'src=');

193 $html->assertElementNotContains('.page-content', 'javascript:');

194 $html->assertElementNotContains('.page-content', 'data:');

195 $html->assertElementNotContains('.page-content', 'base64');

196 }

197 }

198

199 public function test_javascript_uri_links_are_removed()

200 {

201 $checks = [

202 '<a id="xss" href="javascript:alert(document.cookie)>Click me</a>',

203 '<a id="xss" href="javascript: alert(document.cookie)>Click me</a>',

204 '<a id="xss" href="JaVaScRiPt: alert(document.cookie)>Click me</a>',

205 '<a id="xss" href=" JaVaScRiPt: alert(document.cookie)>Click me</a>',

206 ];

207

208 $this->asEditor();

209 $page = Page::query()->first();

210

211 foreach ($checks as $check) {

212 $page->html = $check;

213 $page->save();

214

215 $pageView = $this->get($page->getUrl());

216 $pageView->assertStatus(200);

217 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<a id="xss"');

218 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'href=javascript:');

219 }

220 }

221

222 public function test_form_actions_with_javascript_are_removed()

223 {

224 $checks = [

225 '<form><input id="xss" type=submit formaction=javascript:alert(document.domain) value=Submit><input></form>',

226 '<form ><button id="xss" formaction="JaVaScRiPt:alert(document.domain)">Click me</button></form>',

227 '<form ><button id="xss" formaction=javascript:alert(document.domain)>Click me</button></form>',

228 '<form id="xss" action=javascript:alert(document.domain)><input type=submit value=Submit></form>',

229 '<form id="xss" action="JaVaScRiPt:alert(document.domain)"><input type=submit value=Submit></form>',

230 ];

231

232 $this->asEditor();

233 $page = Page::query()->first();

234

235 foreach ($checks as $check) {

236 $page->html = $check;

237 $page->save();

238

239 $pageView = $this->get($page->getUrl());

240 $pageView->assertStatus(200);

241 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<button id="xss"');

242 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<input id="xss"');

243 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<form id="xss"');

244 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'action=javascript:');

245 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'formaction=javascript:');

246 }

247 }

248

249 public function test_metadata_redirects_are_removed()

250 {

251 $checks = [

252 '<meta http-equiv="refresh" content="0; url=//external_url">',

253 '<meta http-equiv="refresh" ConTeNt="0; url=//external_url">',

254 '<meta http-equiv="refresh" content="0; UrL=//external_url">',

255 ];

256

257 $this->asEditor();

258 $page = Page::query()->first();

259

260 foreach ($checks as $check) {

261 $page->html = $check;

262 $page->save();

263

264 $pageView = $this->get($page->getUrl());

265 $pageView->assertStatus(200);

266 $this->withHtml($pageView)->assertElementNotContains('.page-content', '<meta>');

267 $this->withHtml($pageView)->assertElementNotContains('.page-content', '</meta>');

268 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'content=');

269 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'external_url');

270 }

271 }

272

273 public function test_page_inline_on_attributes_removed_by_default()

274 {

275 $this->asEditor();

276 $page = Page::query()->first();

277 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

278 $page->html = "escape {$script}";

279 $page->save();

280

281 $pageView = $this->get($page->getUrl());

282 $pageView->assertStatus(200);

283 $pageView->assertDontSee($script, false);

284 $pageView->assertSee('<p>Hello</p>', false);

285 }

286

287 public function test_more_complex_inline_on_attributes_escaping_scenarios()

288 {

289 $checks = [

290 '<p onclick="console.log(\'test\')">Hello</p>',

291 '<p OnCliCk="console.log(\'test\')">Hello</p>',

292 '<div>Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p>',

293 '<div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div>',

294 '<div><div><div><div>Lorem ipsum dolor sit amet.<p onclick="console.log(\'test\')">Hello</p></div></div></div></div>',

295 '<div onclick="console.log(\'test\')">Lorem ipsum dolor sit amet.</div><p onclick="console.log(\'test\')">Hello</p><div></div>',

296 '<a a="<img src=1 onerror=\'alert(1)\'> ',

297 '\<a onclick="alert(document.cookie)"\>xss link\</a\>',

298 ];

299

300 $this->asEditor();

301 $page = Page::query()->first();

302

303 foreach ($checks as $check) {

304 $page->html = $check;

305 $page->save();

306

307 $pageView = $this->get($page->getUrl());

308 $pageView->assertStatus(200);

309 $this->withHtml($pageView)->assertElementNotContains('.page-content', 'onclick');

310 }

311 }

312

313 public function test_page_content_scripts_show_when_configured()

314 {

315 $this->asEditor();

316 $page = Page::query()->first();

317 config()->push('app.allow_content_scripts', 'true');

318

319 $script = 'abc123<script>console.log("hello-test")</script>abc123';

320 $page->html = "no escape {$script}";

321 $page->save();

322

323 $pageView = $this->get($page->getUrl());

324 $pageView->assertSee($script, false);

325 $pageView->assertDontSee('abc123abc123');

326 }

327

328 public function test_svg_script_usage_is_removed()

329 {

330 $checks = [

331 '<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',

332 '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>',

333 '<svg><animate href=#xss attributeName=href values=javascript:alert(1) /></svg>',

334 '<svg><animate href="#xss" attributeName="href" values="a;javascript:alert(1)" /></svg>',

335 '<svg><animate href="#xss" attributeName="href" values="a;data:alert(1)" /></svg>',

336 '<svg><animate href=#xss attributeName=href from=javascript:alert(1) to=1 /><a id=xss><text x=20 y=20>XSS</text></a>',

337 '<svg><set href=#xss attributeName=href from=? to=javascript:alert(1) /><a id=xss><text x=20 y=20>XSS</text></a>',

338 '<svg><g><g><g><animate href=#xss attributeName=href values=javascript:alert(1) /></g></g></g></svg>',

339 ];

340

341 $this->asEditor();

342 $page = Page::query()->first();

343

344 foreach ($checks as $check) {

345 $page->html = $check;

346 $page->save();

347

348 $pageView = $this->get($page->getUrl());

349 $pageView->assertStatus(200);

350 $html = $this->withHtml($pageView);

351 $html->assertElementNotContains('.page-content', 'alert');

352 $html->assertElementNotContains('.page-content', 'xlink:href');

353 $html->assertElementNotContains('.page-content', 'application/xml');

354 $html->assertElementNotContains('.page-content', 'javascript');

355 }

356 }

357

358 public function test_page_inline_on_attributes_show_if_configured()

359 {

360 $this->asEditor();

361 $page = Page::query()->first();

362 config()->push('app.allow_content_scripts', 'true');

363

364 $script = '<p onmouseenter="console.log(\'test\')">Hello</p>';

365 $page->html = "escape {$script}";

366 $page->save();

367

368 $pageView = $this->get($page->getUrl());

369 $pageView->assertSee($script, false);

370 $pageView->assertDontSee('<p>Hello</p>', false);

371 }

372

373 public function test_duplicate_ids_does_not_break_page_render()

374 {

375 $this->asEditor();

376 $pageA = Page::query()->first();

377 $pageB = Page::query()->where('id', '!=', $pageA->id)->first();

378

379 $content = '<ul id="bkmrk-xxx-%28"></ul> <ul id="bkmrk-xxx-%28"></ul>';

380 $pageA->html = $content;

381 $pageA->save();

382

383 $pageB->html = '<ul id="bkmrk-xxx-%28"></ul> <p>{{@' . $pageA->id . '#test}}</p>';

384 $pageB->save();

385

386 $pageView = $this->get($pageB->getUrl());

387 $pageView->assertSuccessful();

388 }

389

390 public function test_duplicate_ids_fixed_on_page_save()

391 {

392 $this->asEditor();

393 $page = Page::query()->first();

394

395 $content = '<ul id="bkmrk-test"><li>test a</li><li><ul id="bkmrk-test"><li>test b</li></ul></li></ul>';

396 $pageSave = $this->put($page->getUrl(), [

397 'name' => $page->name,

398 'html' => $content,

399 'summary' => '',

400 ]);

401 $pageSave->assertRedirect();

402

403 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

404 $this->assertEquals(substr_count($updatedPage->html, 'bkmrk-test"'), 1);

405 }

406

407 public function test_anchors_referencing_non_bkmrk_ids_rewritten_after_save()

408 {

409 $this->asEditor();

410 $page = Page::query()->first();

411

412 $content = '<h1 id="non-standard-id">test</h1><p><a href="#non-standard-id">link</a></p>';

413 $this->put($page->getUrl(), [

414 'name' => $page->name,

415 'html' => $content,

416 'summary' => '',

417 ]);

418

419 $updatedPage = Page::query()->where('id', '=', $page->id)->first();

420 $this->assertStringContainsString('id="bkmrk-test"', $updatedPage->html);

421 $this->assertStringContainsString('href="#bkmrk-test"', $updatedPage->html);

422 }

423

424 public function test_get_page_nav_sets_correct_properties()

425 {

426 $content = '<h1 id="testa">Hello</h1><h2 id="testb">There</h2><h3 id="testc">Donkey</h3>';

427 $pageContent = new PageContent(new Page(['html' => $content]));

428 $navMap = $pageContent->getNavigation($content);

429

430 $this->assertCount(3, $navMap);

431 $this->assertArrayMapIncludes([

432 'nodeName' => 'h1',

433 'link' => '#testa',

434 'text' => 'Hello',

435 'level' => 1,

436 ], $navMap[0]);

437 $this->assertArrayMapIncludes([

438 'nodeName' => 'h2',

439 'link' => '#testb',

440 'text' => 'There',

441 'level' => 2,

442 ], $navMap[1]);

443 $this->assertArrayMapIncludes([

444 'nodeName' => 'h3',

445 'link' => '#testc',

446 'text' => 'Donkey',

447 'level' => 3,

448 ], $navMap[2]);

449 }

450

451 public function test_get_page_nav_does_not_show_empty_titles()

452 {

453 $content = '<h1 id="testa">Hello</h1><h2 id="testb"> </h2><h3 id="testc"></h3>';

454 $pageContent = new PageContent(new Page(['html' => $content]));

455 $navMap = $pageContent->getNavigation($content);

456

457 $this->assertCount(1, $navMap);

458 $this->assertArrayMapIncludes([

459 'nodeName' => 'h1',

460 'link' => '#testa',

461 'text' => 'Hello',

462 ], $navMap[0]);

463 }

464

465 public function test_get_page_nav_shifts_headers_if_only_smaller_ones_are_used()

466 {

467 $content = '<h4 id="testa">Hello</h4><h5 id="testb">There</h5><h6 id="testc">Donkey</h6>';

468 $pageContent = new PageContent(new Page(['html' => $content]));

469 $navMap = $pageContent->getNavigation($content);

470

471 $this->assertCount(3, $navMap);

472 $this->assertArrayMapIncludes([

473 'nodeName' => 'h4',

474 'level' => 1,

475 ], $navMap[0]);

476 $this->assertArrayMapIncludes([

477 'nodeName' => 'h5',

478 'level' => 2,

479 ], $navMap[1]);

480 $this->assertArrayMapIncludes([

481 'nodeName' => 'h6',

482 'level' => 3,

483 ], $navMap[2]);

484 }

485

486 public function test_page_text_decodes_html_entities()

487 {

488 $page = Page::query()->first();

489

490 $this->actingAs($this->getAdmin())

491 ->put($page->getUrl(''), [

492 'name' => 'Testing',

493 'html' => '<p>"Hello & welcome"</p>',

494 ]);

495

496 $page->refresh();

497 $this->assertEquals('"Hello & welcome"', $page->text);

498 }

499

500 public function test_page_markdown_table_rendering()

501 {

502 $this->asEditor();

503 $page = Page::query()->first();

504

505 $content = '| Syntax | Description |

506 | ----------- | ----------- |

507 | Header | Title |

508 | Paragraph | Text |';

509 $this->put($page->getUrl(), [

510 'name' => $page->name, 'markdown' => $content,

511 'html' => '', 'summary' => '',

512 ]);

513

514 $page->refresh();

515 $this->assertStringContainsString('</tbody>', $page->html);

516

517 $pageView = $this->get($page->getUrl());

518 $this->withHtml($pageView)->assertElementExists('.page-content table tbody td');

519 }

520

521 public function test_page_markdown_task_list_rendering()

522 {

523 $this->asEditor();

524 $page = Page::query()->first();

525

526 $content = '- [ ] Item a

527 - [x] Item b';

528 $this->put($page->getUrl(), [

529 'name' => $page->name, 'markdown' => $content,

530 'html' => '', 'summary' => '',

531 ]);

532

533 $page->refresh();

534 $this->assertStringContainsString('input', $page->html);

535 $this->assertStringContainsString('type="checkbox"', $page->html);

536

537 $pageView = $this->get($page->getUrl());

538 $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox]');

539 $this->withHtml($pageView)->assertElementExists('.page-content li.task-list-item input[type=checkbox][checked]');

540 }

541

542 public function test_page_markdown_strikethrough_rendering()

543 {

544 $this->asEditor();

545 $page = Page::query()->first();

546

547 $content = '~~some crossed out text~~';

548 $this->put($page->getUrl(), [

549 'name' => $page->name, 'markdown' => $content,

550 'html' => '', 'summary' => '',

551 ]);

552

553 $page->refresh();

554 $this->assertStringMatchesFormat('%A<s%A>some crossed out text</s>%A', $page->html);

555

556 $pageView = $this->get($page->getUrl());

557 $this->withHtml($pageView)->assertElementExists('.page-content p > s');

558 }

559

560 public function test_page_markdown_single_html_comment_saving()

561 {

562 $this->asEditor();

563 $page = Page::query()->first();

564

565 $content = '';

566 $this->put($page->getUrl(), [

567 'name' => $page->name, 'markdown' => $content,

568 'html' => '', 'summary' => '',

569 ]);

570

571 $page->refresh();

572 $this->assertStringMatchesFormat($content, $page->html);

573

574 $pageView = $this->get($page->getUrl());

575 $pageView->assertStatus(200);

576 $pageView->assertSee($content, false);

577 }

578

579 public function test_base64_images_get_extracted_from_page_content()

580 {

581 $this->asEditor();

582 $page = Page::query()->first();

583

584 $this->put($page->getUrl(), [

585 'name' => $page->name, 'summary' => '',

586 'html' => '<p>test<img src="data:image/jpeg;base64,' . $this->base64Jpeg . '"/></p>',

587 ]);

588

589 $page->refresh();

590 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.jpeg">%A</p>%A', $page->html);

591

592 $matches = [];

593 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

594 $imagePath = $matches[1];

595 $imageFile = public_path($imagePath);

596 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

597

598 $this->deleteImage($imagePath);

599 }

600

601 public function test_base64_images_get_extracted_when_containing_whitespace()

602 {

603 $this->asEditor();

604 $page = Page::query()->first();

605

606 $base64PngWithWhitespace = "iVBORw0KGg\noAAAANSUhE\tUgAAAAEAAAA BCA YAAAAfFcSJAAA\n\t ACklEQVR4nGMAAQAABQAB";

607 $base64PngWithoutWhitespace = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQAB';

608 $this->put($page->getUrl(), [

609 'name' => $page->name, 'summary' => '',

610 'html' => '<p>test<img src="data:image/png;base64,' . $base64PngWithWhitespace . '"/></p>',

611 ]);

612

613 $page->refresh();

614 $this->assertStringMatchesFormat('%A<p%A>test<img src="http://localhost/uploads/images/gallery/%A.png">%A</p>%A', $page->html);

615

616 $matches = [];

617 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

618 $imagePath = $matches[1];

619 $imageFile = public_path($imagePath);

620 $this->assertEquals(base64_decode($base64PngWithoutWhitespace), file_get_contents($imageFile));

621

622 $this->deleteImage($imagePath);

623 }

624

625 public function test_base64_images_within_html_blanked_if_not_supported_extension_for_extract()

626 {

627 // Relevant to https://github.com/BookStackApp/BookStack/issues/3010 and other cases

628 $extensions = [

629 'jiff', 'pngr', 'png ', ' png', '.png', 'png.', 'p.ng', ',png',

630 'data:image/png', ',data:image/png',

631 ];

632

633 foreach ($extensions as $extension) {

634 $this->asEditor();

635 $page = Page::query()->first();

636

637 $this->put($page->getUrl(), [

638 'name' => $page->name, 'summary' => '',

639 'html' => '<p>test<img src="data:image/' . $extension . ';base64,' . $this->base64Jpeg . '"/></p>',

640 ]);

641

642 $page->refresh();

643 $this->assertStringContainsString('<img src=""', $page->html);

644 }

645 }

646

647 public function test_base64_images_get_extracted_from_markdown_page_content()

648 {

649 $this->asEditor();

650 $page = Page::query()->first();

651

652 $this->put($page->getUrl(), [

653 'name' => $page->name, 'summary' => '',

654 'markdown' => 'test ![test](data:image/jpeg;base64,' . $this->base64Jpeg . ')',

655 ]);

656

657 $page->refresh();

658 $this->assertStringMatchesFormat('%A<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

659

660 $matches = [];

661 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

662 $imagePath = $matches[1];

663 $imageFile = public_path($imagePath);

664 $this->assertEquals(base64_decode($this->base64Jpeg), file_get_contents($imageFile));

665

666 $this->deleteImage($imagePath);

667 }

668

669 public function test_markdown_base64_extract_not_limited_by_pcre_limits()

670 {

671 $pcreBacktrackLimit = ini_get('pcre.backtrack_limit');

672 $pcreRecursionLimit = ini_get('pcre.recursion_limit');

673

674 $this->asEditor();

675 $page = Page::query()->first();

676

677 ini_set('pcre.backtrack_limit', '500');

678 ini_set('pcre.recursion_limit', '500');

679

680 $content = str_repeat('a', 5000);

681 $base64Content = base64_encode($content);

682

683 $this->put($page->getUrl(), [

684 'name' => $page->name, 'summary' => '',

685 'markdown' => 'test ![test](data:image/jpeg;base64,' . $base64Content . ') ![test](data:image/jpeg;base64,' . $base64Content . ')',

686 ]);

687

688 $page->refresh();

689 $this->assertStringMatchesFormat('<p%A>test <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test"> <img src="http://localhost/uploads/images/gallery/%A.jpeg" alt="test">%A</p>%A', $page->html);

690

691 $matches = [];

692 preg_match('/src="https:\/\/p.rizon.top:443\/http\/localhost(.*?)"/', $page->html, $matches);

693 $imagePath = $matches[1];

694 $imageFile = public_path($imagePath);

695 $this->assertEquals($content, file_get_contents($imageFile));

696

697 $this->deleteImage($imagePath);

698 ini_set('pcre.backtrack_limit', $pcreBacktrackLimit);

699 ini_set('pcre.recursion_limit', $pcreRecursionLimit);

700 }

701