setLanguage(); } /** * Tests for proper escaping of XSS. */ public function testXssInHref(): void { self::assertSame( '[a@javascript:alert('XSS');@target]link', Sanitize::convertBBCode('[a@javascript:alert(\'XSS\');@target]link[/a]'), ); } /** * Tests correct generating of link redirector. */ public function testLink(): void { $lang = Current::$lang; Current::$lang = ''; self::assertSame( 'link', Sanitize::convertBBCode('[a@https://www.phpmyadmin.net/@target]link[/a]'), ); Current::$lang = $lang; } /** * Tests links to documentation. * * @param string $link link * @param string $expected expected result */ #[DataProvider('docLinks')] public function testDoc(string $link, string $expected): void { self::assertSame( 'doclink', Sanitize::convertBBCode('[doc@' . $link . ']doclink[/doc]'), ); } /** * Data provider for sanitize [doc@foo] markup * * @return string[][] */ public static function docLinks(): array { return [ ['foo', 'setup.html%23foo'], ['cfg_TitleTable', 'config.html%23cfg_TitleTable'], ['faq3-11', 'faq.html%23faq3-11'], ['bookmarks@', 'bookmarks.html'], ]; } /** * Tests link target validation. */ public function testInvalidTarget(): void { self::assertSame( '[a@./Documentation.html@INVALID9]doc', Sanitize::convertBBCode('[a@./Documentation.html@INVALID9]doc[/a]'), ); } /** * Tests XSS escaping after valid link. */ public function testLinkDocXss(): void { self::assertSame( '[a@./Documentation.html" onmouseover="alert(foo)"]doc', Sanitize::convertBBCode('[a@./Documentation.html" onmouseover="alert(foo)"]doc[/a]'), ); } /** * Tests proper handling of multi link code. */ public function testLinkAndXssInHref(): void { self::assertSame( 'doc' . '[a@javascript:alert('XSS');@target]link', Sanitize::convertBBCode( '[a@https://docs.phpmyadmin.net/]doc[/a][a@javascript:alert(\'XSS\');@target]link[/a]', ), ); } /** * Test escaping of HTML tags */ public function testHtmlTags(): void { self::assertSame( '<div onclick="">', Sanitize::convertBBCode('
'), ); } /** * Tests basic BB code. */ public function testBBCode(): void { self::assertSame( 'strong', Sanitize::convertBBCode('[strong]strong[/strong]'), ); } #[DataProvider('providerTestSanitizeFileName')] public function testSanitizeFilename(string $expected, string $input, bool $replaceDot): void { self::assertSame($expected, Sanitize::sanitizeFilename($input, $replaceDot)); } /** @return list */ public static function providerTestSanitizeFileName(): array { return [ ['Hello123', 'Hello123', false], ['宮保雞丁', '宮保雞丁', false], ['Україна', 'Україна', false], ['-_-', '-.-', true], ['-.-', '-.-', false], ['___', '"\'"', false], ['_test_', '', false], ['Hello__World_', "Hello\r\nWorld!", false], ['_', "\u{fffd}", false], ['_', '🚀', false], [str_repeat('_', 32), implode('', range("\0", "\x1f")), false], ]; } /** * Test for Sanitize::getJsValue * * @param string $key Key * @param string|bool|int|string[] $value Value * @param string $expected Expected output */ #[DataProvider('variables')] public function testGetJsValue(string $key, string|bool|int|array $value, string $expected): void { self::assertSame($expected, Sanitize::getJsValue($key, $value)); } /** * Provider for testFormat * * @return array */ public static function variables(): array { return [ ['foo', true, "foo = true;\n"], ['foo', false, "foo = false;\n"], ['foo', 100, "foo = 100;\n"], ['foo', 0, "foo = 0;\n"], ['foo', 'text', "foo = \"text\";\n"], ['foo', 'quote"', "foo = \"quote\\\"\";\n"], ['foo', 'apostroph\'', "foo = \"apostroph'\";\n"], ['foo', ['1', '2', '3'], "foo = [\"1\",\"2\",\"3\"];\n"], ['foo', 'bar"baz', "foo = \"bar\\\"baz\";\n"], ]; } /** * Data provider for sanitize links * * @return array */ public static function dataProviderCheckLinks(): array { // Expected // The url // Allow http links // Allow other links return [ [false, 'foo', false, false], [true, './docs/html/', false, false], [false, 'index.php', false, false], [false, './index.php', false, false], [true, './index.php?', false, false], [true, './index.php?route=/server/sql', false, false], [false, 'index.php?route=/server/sql', false, false], [false, 'ftp://ftp.example.com', false, false], [true, 'ftp://ftp.example.com', false, true], [false, 'mailto:admin@domain.tld', false, false], [true, 'mailto:admin@domain.tld', false, true], [false, 'index.php?route=/url&url=https://example.com', false, false], [true, 'index.php?route=/url&url=https%3a%2f%2fexample.com', false, false], [true, 'https://example.com', false, false], [false, 'http://example.com', false, false], [true, 'http://example.com', true, false], ]; } /** * Tests link sanitize */ #[DataProvider('dataProviderCheckLinks')] public function testCheckLink(bool $expected, string $url, bool $http, bool $other): void { self::assertSame( $expected, Sanitize::checkLink($url, $http, $other), ); } }