From 85b59d07b64ad45fe5213a173e5857418620d171 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sat, 22 Sep 2018 03:44:19 +0000
Subject: [PATCH] test: add smoketests for the scrubbing policies

---
 test/html_test.exs | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 test/html_test.exs

diff --git a/test/html_test.exs b/test/html_test.exs
new file mode 100644
index 000000000..f7150759b
--- /dev/null
+++ b/test/html_test.exs
@@ -0,0 +1,80 @@
+defmodule Pleroma.HTMLTest do
+  alias Pleroma.HTML
+  use Pleroma.DataCase
+
+  @html_sample """
+    <b>this is in bold</b>
+    <p>this is a paragraph</p>
+    this is a linebreak<br />
+    this is an image: <img src="http://example.com/image.jpg"><br />
+    <script>alert('hacked')</script>
+  """
+
+  @html_onerror_sample """
+    <img src="http://example.com/image.jpg" onerror="alert('hacked')">
+  """
+
+  describe "StripTags scrubber" do
+    test "works as expected" do
+      expected = """
+      this is in bold
+        this is a paragraph
+        this is a linebreak
+        this is an image: 
+        alert('hacked')
+      """
+
+      assert expected == HTML.strip_tags(@html_sample)
+    end
+
+    test "does not allow attribute-based XSS" do
+      expected = "\n"
+
+      assert expected == HTML.strip_tags(@html_onerror_sample)
+    end
+  end
+
+  describe "TwitterText scrubber" do
+    test "normalizes HTML as expected" do
+      expected = """
+      this is in bold
+        <p>this is a paragraph</p>
+        this is a linebreak<br />
+        this is an image: <img src="http://example.com/image.jpg" /><br />
+        alert('hacked')
+      """
+
+      assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.TwitterText)
+    end
+
+    test "does not allow attribute-based XSS" do
+      expected = """
+      <img src="http://example.com/image.jpg" />
+      """
+
+      assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.TwitterText)
+    end
+  end
+
+  describe "default scrubber" do
+    test "normalizes HTML as expected" do
+      expected = """
+      <b>this is in bold</b>
+        <p>this is a paragraph</p>
+        this is a linebreak<br />
+        this is an image: <img src="http://example.com/image.jpg" /><br />
+        alert('hacked')
+      """
+
+      assert expected == HTML.filter_tags(@html_sample, Pleroma.HTML.Scrubber.Default)
+    end
+
+    test "does not allow attribute-based XSS" do
+      expected = """
+      <img src="http://example.com/image.jpg" />
+      """
+
+      assert expected == HTML.filter_tags(@html_onerror_sample, Pleroma.HTML.Scrubber.Default)
+    end
+  end
+end