- Update tests

release-0.7
alecpl 13 years ago
parent 96c946ee6c
commit 984ee8ce92

@ -92,7 +92,7 @@ class rcube_test_mailfunc extends UnitTestCase
function test_html_xss2()
{
$part = $this->get_html_part('src/BID-26800.txt');
$washed = rcmail_print_body($part, array('safe' => true));
$washed = rcmail_html4inline(rcmail_print_body($part, array('safe' => true)), 'dabody', '', $attr, true);
$this->assertNoPattern('/alert|expression|javascript|xss/', $washed, "Remove evil style blocks");
$this->assertNoPattern('/font-style:italic/', $washed, "Allow valid styles");

@ -10,13 +10,14 @@
<h1>2 test</h1>
<p>&lt;div&gt; block</p>
<div style="font-style:italic">valid css</div>
<div style="color:red; background:url('//somedomain.com/somepath/somefile.png')">
<div style="{ left:expression( alert(&#039;expression!&#039;) ) }">
<div style="{ background:url( alert(&#039;URL!&#039;) ) }">
<h1>3 test</h1>
<p>Inject comment text</p>
<div style="{ left:exp/* */ression( alert(&#039;xss3&#039;) ) }">
<div style="{ background:u/* */rl( alert(&#039;xssurl3&#039;) ) }">
<div style=" background:u/* */rl( alert(&#039;xssurl3&#039;) ) ">
<h1>4 test</h1>
<p>Using reverse solid to directe the codepoint</p>

Loading…
Cancel
Save