SanitizerTest.php 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181
  1. <?php
  2. require 'data/TestAllowedTags.php';
  3. require 'data/TestAllowedAttributes.php';
  4. use \enshrined\svgSanitize\Sanitizer;
  5. /**
  6. * Class SanitizerTest
  7. */
  8. class SanitizerTest extends PHPUnit_Framework_TestCase
  9. {
  10. /**
  11. * @var Sanitizer
  12. */
  13. protected $class;
  14. /**
  15. * Set up the test class
  16. */
  17. public function setUp()
  18. {
  19. $this->class = new Sanitizer();
  20. }
  21. /**
  22. * Make sure the initial tags are loaded
  23. */
  24. public function testLoadDefaultTags()
  25. {
  26. $tags = $this->class->getAllowedTags();
  27. $this->assertInternalType('array', $tags);
  28. }
  29. /**
  30. * Make sure the initial attributes are loaded
  31. */
  32. public function testLoadDefaultAttributes()
  33. {
  34. $attributes = $this->class->getAllowedAttrs();
  35. $this->assertInternalType('array', $attributes);
  36. }
  37. /**
  38. * Test the custom tag setters and getters
  39. */
  40. public function testSetCustomTags()
  41. {
  42. $this->class->setAllowedTags(new TestAllowedTags());
  43. $tags = $this->class->getAllowedTags();
  44. $this->assertInternalType('array', $tags);
  45. $this->assertEquals(TestAllowedTags::getTags(), $tags);
  46. }
  47. /**
  48. * Test the custom attribute setters and getters
  49. */
  50. public function testSetCustomAttributes()
  51. {
  52. $this->class->setAllowedAttrs(new TestAllowedAttributes());
  53. $attributes = $this->class->getAllowedAttrs();
  54. $this->assertInternalType('array', $attributes);
  55. $this->assertEquals(TestAllowedAttributes::getAttributes(), $attributes);
  56. }
  57. /**
  58. * Test that malicious elements and attributes are removed from standard XML
  59. */
  60. public function testSanitizeXMLDoc()
  61. {
  62. $initialData = file_get_contents('tests/data/xmlTestOne.xml');
  63. $expected = file_get_contents('tests/data/xmlCleanOne.xml');
  64. $cleanData = $this->class->sanitize($initialData);
  65. $this->assertXmlStringEqualsXmlString($expected, $cleanData);
  66. }
  67. /**
  68. * Test that malicious elements and attributes are removed from an SVG
  69. */
  70. public function testSanitizeSVGDoc()
  71. {
  72. $initialData = file_get_contents('tests/data/svgTestOne.svg');
  73. $expected = file_get_contents('tests/data/svgCleanOne.svg');
  74. $cleanData = $this->class->sanitize($initialData);
  75. $this->assertXmlStringEqualsXmlString($expected, $cleanData);
  76. }
  77. /**
  78. * Test that a badly formatted XML document returns false
  79. */
  80. public function testBadXMLReturnsFalse()
  81. {
  82. $initialData = file_get_contents('tests/data/badXmlTestOne.svg');
  83. $cleanData = $this->class->sanitize($initialData);
  84. $this->assertEquals(false, $cleanData);
  85. }
  86. /**
  87. * Make sure that hrefs get sanitized correctly
  88. */
  89. public function testSanitizeHrefs()
  90. {
  91. $initialData = file_get_contents('tests/data/hrefTestOne.svg');
  92. $expected = file_get_contents('tests/data/hrefCleanOne.svg');
  93. $cleanData = $this->class->sanitize($initialData);
  94. $this->assertXmlStringEqualsXmlString($expected, $cleanData);
  95. }
  96. /**
  97. * Make sure that external references get sanitized correctly
  98. */
  99. public function testSanitizeExternal()
  100. {
  101. $initialData = file_get_contents('tests/data/externalTest.svg');
  102. $expected = file_get_contents('tests/data/externalClean.svg');
  103. $this->class->removeRemoteReferences(true);
  104. $cleanData = $this->class->sanitize($initialData);
  105. $this->class->removeRemoteReferences(false);
  106. $this->assertXmlStringEqualsXmlString($expected, $cleanData);
  107. }
  108. /**
  109. * Test that minification of an SVG works
  110. */
  111. public function testSanitizeAndMinifiySVGDoc()
  112. {
  113. $initialData = file_get_contents('tests/data/svgTestOne.svg');
  114. $expected = file_get_contents('tests/data/svgCleanOneMinified.svg');
  115. $this->class->minify(true);
  116. $cleanData = $this->class->sanitize($initialData);
  117. $this->class->minify(false);
  118. $this->assertXmlStringEqualsXmlString($expected, $cleanData);
  119. }
  120. /**
  121. * Test that ARIA and Data Attributes are allowed
  122. */
  123. public function testThatAriaAndDataAttributesAreAllowed()
  124. {
  125. $initialData = file_get_contents('tests/data/ariaDataTest.svg');
  126. $expected = file_get_contents('tests/data/ariaDataClean.svg');
  127. $this->class->minify(false);
  128. $cleanData = $this->class->sanitize($initialData);
  129. $this->class->minify(false);
  130. $this->assertXmlStringEqualsXmlString($expected, $cleanData);
  131. }
  132. /**
  133. * Test that ARIA and Data Attributes are allowed
  134. */
  135. public function testThatExternalUseElementsAreStripped()
  136. {
  137. $initialData = file_get_contents('tests/data/useTest.svg');
  138. $expected = file_get_contents('tests/data/useClean.svg');
  139. $this->class->minify(false);
  140. $cleanData = $this->class->sanitize($initialData);
  141. $this->class->minify(false);
  142. $this->assertXmlStringEqualsXmlString($expected, $cleanData);
  143. }
  144. }