add test cases for sanitization hardening

markedjs · Jun 26, 2019 · 506704a · 506704a
1 parent 08389db
commit 506704a
Show file tree

Hide file tree

Showing 9 changed files with 38 additions and 0 deletions.
diff --git a/test/specs/run-spec.js b/test/specs/run-spec.js
@@ -16,6 +16,8 @@ function runSpecs(title, dir, showCompletionTable, options) {
  spec.options = Object.assign({}, options, (spec.options || {}));
  const example = (spec.example ? ' example ' + spec.example : '');
  const passFail = (spec.shouldFail ? 'fail' : 'pass');
+ if (spec.options.sanitizerRemoveHtml)
+ spec.options.sanitizer = () => '';
  (spec.only ? fit : it)('should ' + passFail + example, () => {
  const before = process.hrtime();
  if (spec.shouldFail) {
@@ -40,3 +42,4 @@ runSpecs('CommonMark', './commonmark', true, { headerIds: false });
 runSpecs('Original', './original', false, { gfm: false });
 runSpecs('New', './new');
 runSpecs('ReDOS', './redos');
+runSpecs('Security', './security', false, { silent: true /* no deprecation warnings */ });
diff --git a/test/specs/security/sanitizer_bypass.html b/test/specs/security/sanitizer_bypass.html
@@ -0,0 +1,6 @@
+<p>AAA&lt;script&gt; &lt;img &lt;script&gt; src=x onerror=alert(1) /&gt;BBB</p>
+
+<p>AAA&lt;sometag&gt; &lt;img &lt;sometag&gt; src=x onerror=alert(1)BBB</p>
+
+<p>&lt;a&gt;a2&lt;a2t&gt;a2&lt;/a&gt; b &lt;c&gt;c&lt;/c&gt; d</p>
+<h1 id="text"><img src="URL" alt="text"></h1>
diff --git a/test/specs/security/sanitizer_bypass.md b/test/specs/security/sanitizer_bypass.md
@@ -0,0 +1,9 @@
+---
+sanitize: true
+---
+AAA<script> <img <script> src=x onerror=alert(1) />BBB
+
+AAA<sometag> <img <sometag> src=x onerror=alert(1)BBB
+
+<a>a2<a2t>a2</a> b <c>c</c> d
+# ![text](URL)
diff --git a/test/specs/security/sanitizer_bypass_remove_generic.html b/test/specs/security/sanitizer_bypass_remove_generic.html
@@ -0,0 +1,2 @@
+<p>a2a2 b c d</p>
+<h1 id="text"><img src="URL" alt="text"></h1>
diff --git a/test/specs/security/sanitizer_bypass_remove_generic.md b/test/specs/security/sanitizer_bypass_remove_generic.md
@@ -0,0 +1,6 @@
+---
+sanitize: true
+sanitizerRemoveHtml: true
+---
+<a>a2<a2t>a2</a> b <c>c</c> d
+# ![text](URL)
diff --git a/test/specs/security/sanitizer_bypass_remove_script.html b/test/specs/security/sanitizer_bypass_remove_script.html
@@ -0,0 +1 @@
+<p>AAA</p>
diff --git a/test/specs/security/sanitizer_bypass_remove_script.md b/test/specs/security/sanitizer_bypass_remove_script.md
@@ -0,0 +1,5 @@
+---
+sanitize: true
+sanitizerRemoveHtml: true
+---
+AAA<script> <img <script> src=x onerror=alert(1) />BBB
diff --git a/test/specs/security/sanitizer_bypass_remove_tag.html b/test/specs/security/sanitizer_bypass_remove_tag.html
@@ -0,0 +1 @@
+<p>AAA &lt;img src=x onerror=alert(1)BBB</p>
diff --git a/test/specs/security/sanitizer_bypass_remove_tag.md b/test/specs/security/sanitizer_bypass_remove_tag.md
@@ -0,0 +1,5 @@
+---
+sanitize: true
+sanitizerRemoveHtml: true
+---
+AAA<sometag> <img <sometag> src=x onerror=alert(1)BBB