return $html;
}
- $html = '<body>' . $html . '</body>';
+ $html = '<?xml encoding="utf-8" ?><body>' . $html . '</body>';
libxml_use_internal_errors(true);
$doc = new DOMDocument();
- $doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'), LIBXML_SCHEMA_CREATE);
+ $doc->loadHTML($html, LIBXML_SCHEMA_CREATE);
$xPath = new DOMXPath($doc);
// Apply to scripts
namespace Tests\Settings;
+use BookStack\Util\CspService;
use Tests\TestCase;
class CustomHeadContentTest extends TestCase
$resp = $this->get('/login');
$resp->assertSee('<div id="hello">cat</div>');
}
+
+ public function test_nonce_application_handles_edge_cases()
+ {
+ $mockCSP = $this->mock(CspService::class);
+ $mockCSP->shouldReceive('getNonce')->andReturn('abc123');
+
+ $content = trim('
+<script>console.log("cat");</script>
+<script type="text/html"><\script>const a = `<div></div>`<\/\script></script>
+<script >const a = `<div></div>`;</script>
+<script type="<script text>test">const c = `<div></div>`;</script>
+<script
+ type="text/html"
+>
+const a = `<\script><\/script>`;
+const b = `<script`;
+</script>
+<SCRIPT>const b = `↗️£`;</SCRIPT>
+ ');
+
+ $expectedOutput = trim('
+<script nonce="abc123">console.log("cat");</script>
+<script type="text/html" nonce="abc123"><\script>const a = `<div></div>`<\/\script></script>
+<script nonce="abc123">const a = `<div></div>`;</script>
+<script type="<script text>test" nonce="abc123">const c = `<div></div>`;</script>
+<script type="text/html" nonce="abc123">
+const a = `<\script><\/script>`;
+const b = `<script`;
+</script>
+<script nonce="abc123">const b = `↗️£`;</script>
+ ');
+
+ $this->setSettings(['app-custom-head' => $content]);
+ $resp = $this->get('/login');
+ $resp->assertSee($expectedOutput);
+ }
}
projects / bookstack / commitdiff