setLanguage();
}
/**
* Tests for proper escaping of XSS.
*/
public function testXssInHref(): void
{
self::assertSame(
'[a@javascript:alert('XSS');@target]link',
Sanitize::convertBBCode('[a@javascript:alert(\'XSS\');@target]link[/a]'),
);
}
/**
* Tests correct generating of link redirector.
*/
public function testLink(): void
{
$lang = Current::$lang;
Current::$lang = '';
self::assertSame(
'link',
Sanitize::convertBBCode('[a@https://www.phpmyadmin.net/@target]link[/a]'),
);
Current::$lang = $lang;
}
/**
* Tests links to documentation.
*
* @param string $link link
* @param string $expected expected result
*/
#[DataProvider('docLinks')]
public function testDoc(string $link, string $expected): void
{
self::assertSame(
'doclink',
Sanitize::convertBBCode('[doc@' . $link . ']doclink[/doc]'),
);
}
/**
* Data provider for sanitize [doc@foo] markup
*
* @return string[][]
*/
public static function docLinks(): array
{
return [
['foo', 'setup.html%23foo'],
['cfg_TitleTable', 'config.html%23cfg_TitleTable'],
['faq3-11', 'faq.html%23faq3-11'],
['bookmarks@', 'bookmarks.html'],
];
}
/**
* Tests link target validation.
*/
public function testInvalidTarget(): void
{
self::assertSame(
'[a@./Documentation.html@INVALID9]doc',
Sanitize::convertBBCode('[a@./Documentation.html@INVALID9]doc[/a]'),
);
}
/**
* Tests XSS escaping after valid link.
*/
public function testLinkDocXss(): void
{
self::assertSame(
'[a@./Documentation.html" onmouseover="alert(foo)"]doc',
Sanitize::convertBBCode('[a@./Documentation.html" onmouseover="alert(foo)"]doc[/a]'),
);
}
/**
* Tests proper handling of multi link code.
*/
public function testLinkAndXssInHref(): void
{
self::assertSame(
'doc'
. '[a@javascript:alert('XSS');@target]link',
Sanitize::convertBBCode(
'[a@https://docs.phpmyadmin.net/]doc[/a][a@javascript:alert(\'XSS\');@target]link[/a]',
),
);
}
/**
* Test escaping of HTML tags
*/
public function testHtmlTags(): void
{
self::assertSame(
'<div onclick="">',
Sanitize::convertBBCode('
'),
);
}
/**
* Tests basic BB code.
*/
public function testBBCode(): void
{
self::assertSame(
'
strong',
Sanitize::convertBBCode('[strong]strong[/strong]'),
);
}
#[DataProvider('providerTestSanitizeFileName')]
public function testSanitizeFilename(string $expected, string $input, bool $replaceDot): void
{
self::assertSame($expected, Sanitize::sanitizeFilename($input, $replaceDot));
}
/** @return list
*/
public static function providerTestSanitizeFileName(): array
{
return [
['Hello123', 'Hello123', false],
['宮保雞丁', '宮保雞丁', false],
['Україна', 'Україна', false],
['-_-', '-.-', true],
['-.-', '-.-', false],
['___', '"\'"', false],
['_test_', '', false],
['Hello__World_', "Hello\r\nWorld!", false],
['_', "\u{fffd}", false],
['_', '🚀', false],
[str_repeat('_', 32), implode('', range("\0", "\x1f")), false],
];
}
/**
* Test for Sanitize::getJsValue
*
* @param string $key Key
* @param string|bool|int|string[] $value Value
* @param string $expected Expected output
*/
#[DataProvider('variables')]
public function testGetJsValue(string $key, string|bool|int|array $value, string $expected): void
{
self::assertSame($expected, Sanitize::getJsValue($key, $value));
}
/**
* Provider for testFormat
*
* @return array
*/
public static function variables(): array
{
return [
['foo', true, "foo = true;\n"],
['foo', false, "foo = false;\n"],
['foo', 100, "foo = 100;\n"],
['foo', 0, "foo = 0;\n"],
['foo', 'text', "foo = \"text\";\n"],
['foo', 'quote"', "foo = \"quote\\\"\";\n"],
['foo', 'apostroph\'', "foo = \"apostroph'\";\n"],
['foo', ['1', '2', '3'], "foo = [\"1\",\"2\",\"3\"];\n"],
['foo', 'bar"baz', "foo = \"bar\\\"baz\";\n"],
];
}
/**
* Data provider for sanitize links
*
* @return array
*/
public static function dataProviderCheckLinks(): array
{
// Expected
// The url
// Allow http links
// Allow other links
return [
[false, 'foo', false, false],
[true, './docs/html/', false, false],
[false, 'index.php', false, false],
[false, './index.php', false, false],
[true, './index.php?', false, false],
[true, './index.php?route=/server/sql', false, false],
[false, 'index.php?route=/server/sql', false, false],
[false, 'ftp://ftp.example.com', false, false],
[true, 'ftp://ftp.example.com', false, true],
[false, 'mailto:admin@domain.tld', false, false],
[true, 'mailto:admin@domain.tld', false, true],
[false, 'index.php?route=/url&url=https://example.com', false, false],
[true, 'index.php?route=/url&url=https%3a%2f%2fexample.com', false, false],
[true, 'https://example.com', false, false],
[false, 'http://example.com', false, false],
[true, 'http://example.com', true, false],
];
}
/**
* Tests link sanitize
*/
#[DataProvider('dataProviderCheckLinks')]
public function testCheckLink(bool $expected, string $url, bool $http, bool $other): void
{
self::assertSame(
$expected,
Sanitize::checkLink($url, $http, $other),
);
}
}