57 lines
1.7 KiB
Python
57 lines
1.7 KiB
Python
 
|
"""HTML sanitization (SPEC §6.4, §10.4, I-8)."""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import uuid
|
||
|
|
|
||
|
|
from app.indexer.sanitize import sanitize_html
|
||
|
|
|
||
|
|
MID = uuid.uuid4()
|
||
|
|
|
||
|
|
|
||
|
|
def test_scripts_and_handlers_are_removed() -> None:
|
||
|
|
html = '<div onclick="evil()">hi<script>alert(1)</script></div>'
|
||
|
|
result = sanitize_html(html, MID)
|
||
|
|
assert "<script" not in result.html.lower()
|
||
|
|
assert "onclick" not in result.html.lower()
|
||
|
|
assert "hi" in result.html
|
||
|
|
|
||
|
|
|
||
|
|
def test_remote_image_is_blocked_and_flagged() -> None:
|
||
|
|
html = '<p>see <img src="http://tracker.example/pixel.gif"> this</p>'
|
||
|
|
result = sanitize_html(html, MID)
|
||
|
|
assert result.has_remote_images
|
||
|
|
assert "tracker.example" not in result.html
|
||
|
|
|
||
|
|
|
||
|
|
def test_cid_image_is_rewritten_to_endpoint() -> None:
|
||
|
|
html = '<img src="cid:logo123">'
|
||
|
|
result = sanitize_html(html, MID)
|
||
|
|
assert f"/api/messages/{MID}/cid/logo123" in result.html
|
||
|
|
assert not result.has_remote_images
|
||
|
|
|
||
|
|
|
||
|
|
def test_data_image_is_preserved() -> None:
|
||
|
|
html = '<img src="data:image/png;base64,iVBORw0KGgo=">'
|
||
|
|
result = sanitize_html(html, MID)
|
||
|
|
assert "data:image/png" in result.html
|
||
|
|
assert not result.has_remote_images
|
||
|
|
|
||
|
|
|
||
|
|
def test_safe_links_survive_with_rel() -> None:
|
||
|
|
html = '<a href="https://example.com">link</a>'
|
||
|
|
result = sanitize_html(html, MID)
|
||
|
|
assert "https://example.com" in result.html
|
||
|
|
assert "javascript:" not in result.html.lower()
|
||
|
|
|
||
|
|
|
||
|
|
def test_javascript_uri_is_stripped() -> None:
|
||
|
|
html = '<a href="javascript:alert(1)">x</a>'
|
||
|
|
result = sanitize_html(html, MID)
|
||
|
|
assert "javascript:" not in result.html.lower()
|
||
|
|
|
||
|
|
|
||
|
|
def test_sanitizer_version_reported() -> None:
|
||
|
|
result = sanitize_html("<p>hi</p>", MID)
|
||
|
|
assert result.sanitizer_v >= 1
|