webmail-client/backend/tests/indexer/test_sanitize.py

"""HTML sanitization (SPEC §6.4, §10.4, I-8)."""

from __future__ import annotations

import uuid

import pytest

from app.indexer.sanitize import sanitize_html

MID = uuid.uuid4()


def test_scripts_and_handlers_are_removed() -> None:
    html = '<div onclick="evil()">hi<script>alert(1)</script></div>'
    result = sanitize_html(html, MID)
    assert "<script" not in result.html.lower()
    assert "onclick" not in result.html.lower()
    assert "hi" in result.html


def test_document_title_is_not_rendered() -> None:
    # Newsletters put "mailer" or the subject in <title>; unwrapping the tag would
    # show it as a stray line above the body. Hidden preheaders keep their style.
    html = (
        "<html><head><title>mailer</title></head><body>"
        '<span style="display:none">preview</span><p>Hi</p></body></html>'
    )
    result = sanitize_html(html, MID)
    assert "mailer" not in result.html
    assert '<span style="display:none">preview</span>' in result.html
    assert "<p>Hi</p>" in result.html


def test_remote_image_is_blocked_and_flagged() -> None:
    html = '<p>see <img src="http://tracker.example/pixel.gif"> this</p>'
    result = sanitize_html(html, MID)
    assert result.has_remote_images
    assert "tracker.example" not in result.html


def test_cid_image_is_rewritten_to_endpoint() -> None:
    html = '<img src="cid:logo123">'
    result = sanitize_html(html, MID)
    assert f"/api/messages/{MID}/cid/logo123" in result.html
    assert not result.has_remote_images


def test_data_image_is_preserved() -> None:
    html = '<img src="data:image/png;base64,iVBORw0KGgo=">'
    result = sanitize_html(html, MID)
    assert "data:image/png" in result.html
    assert not result.has_remote_images


def test_safe_links_survive_with_rel() -> None:
    html = '<a href="https://example.com">link</a>'
    result = sanitize_html(html, MID)
    assert "https://example.com" in result.html
    assert "javascript:" not in result.html.lower()


def test_javascript_uri_is_stripped() -> None:
    html = '<a href="javascript:alert(1)">x</a>'
    result = sanitize_html(html, MID)
    assert "javascript:" not in result.html.lower()


def test_sanitizer_version_reported() -> None:
    result = sanitize_html("<p>hi</p>", MID)
    assert result.sanitizer_v >= 1


def test_style_block_and_classes_are_kept() -> None:
    # Mailers (e.g. Fastmail invites) put layout in a <style> block + classes.
    html = '<style>.banner{color:#333}</style><div class="banner">hi</div>'
    result = sanitize_html(html, MID)
    assert "<style" in result.html.lower()
    assert ".banner" in result.html
    assert 'class="banner"' in result.html


def test_style_block_script_css_is_dropped() -> None:
    html = '<style>.x{width:expression(alert(1))}</style><p class="x">hi</p>'
    result = sanitize_html(html, MID)
    assert "expression(" not in result.html.lower()
    # the block is nuked but the element/class survive
    assert 'class="x"' in result.html


def test_style_block_import_and_url_stripped_when_remote_blocked() -> None:
    html = "<style>@import url('http://evil/x.css'); .b{background:url(http://evil/p.gif)}</style>"
    result = sanitize_html(html, MID)
    assert "@import" not in result.html.lower()
    assert "evil" not in result.html.lower()
    assert result.has_remote_images


def test_script_content_still_stripped_with_style_allowed() -> None:
    html = "<script>alert(1)</script><style>.a{color:red}</style>"
    result = sanitize_html(html, MID)
    assert "alert(1)" not in result.html
    assert ".a{color:red}" in result.html


# --- Tracking pixels ---------------------------------------------------------------


@pytest.mark.parametrize(
    "tag",
    [
        '<img src="https://t.example.com/o.gif?u=1" width="1" height="1">',
        '<img src="https://t.example.com/o.gif" width="1px" height="1px" border="0">',
        "<img src='https://t.example.com/x' style='width:1px;height:1px'>",
        '<img src="https://t.example.com/x" style="display:none">',
        '<img src="https://x.list-manage.com/track/open.php?u=1&id=2">',
        '<img src="https://u1.ct.sendgrid.net/wf/open?upn=abc" alt="">',
        '<img src="https://mailtrack.io/trace/mail/abc.png">',
        # Squeezed to a pixel by max-width, its height following.
        '<img src="https://x.example/p.heic" width="1" height="1" '
        'style="display:block; height:auto; max-width:1px !important; width:100%">',
        '<img src="https://x.example/p" width="0" height="0" style="border:0;width:0;height:0;">',
    ],
)
def test_tracking_pixels_are_removed_and_counted(tag: str) -> None:
    html = f"<p>Hello</p>{tag}<p>Bye</p>"
    for allow in (False, True):
        result = sanitize_html(html, MID, allow_remote_images=allow)
        assert result.trackers_blocked == 1
        assert "<img" not in result.html
        assert "Hello" in result.html and "Bye" in result.html
    # A pixel alone is no reason to offer "Load images".
    assert sanitize_html(html, MID).has_remote_images is False


@pytest.mark.parametrize(
    "tag",
    [
        '<img src="https://cdn.example.com/logo.png" width="180" height="47">',
        '<img src="https://cdn.example.com/photo.jpg">',
        '<img src="https://cdn.example.com/spacer.gif" width="1" height="40">',
        '<img src="cid:logo" width="1" height="1">',
        # Outlook signature logos: sizes in inches, not pixels.
        '<img width="30" height="30" style="width:0.3125in; height:0.3125in" '
        'src="https://pfx.tv/img/sig/logo.png">',
        '<img style="width:1.5em;height:1.5em" src="https://cdn.example.com/icon.png">',
        '<img style="width:1%;height:1%" src="https://cdn.example.com/bar.png">',
        '<img style="width:1pt;height:1pt" src="https://cdn.example.com/dot.png">',
        # Attributes say 1x1, the style draws it full width.
        '<img src="https://cdn.example.com/photo.jpg" width="1" height="1" '
        'style="width:100%;height:auto">',
    ],
)
def test_real_images_are_kept(tag: str) -> None:
    result = sanitize_html(f"<p>x</p>{tag}", MID, allow_remote_images=True)
    assert result.trackers_blocked == 0
    assert "<img" in result.html


@pytest.mark.parametrize("size", [".", "1.2.3", "..", "", "px", "1e3", "-1"])
def test_malformed_sizes_never_break_sanitizing(size: str) -> None:
    tag = f'<img src="https://cdn.example.com/a.png" width="{size}" height="{size}">'
    result = sanitize_html(f"<p>x</p>{tag}", MID, allow_remote_images=True)
    assert result.trackers_blocked == 0
    css = f'<img src="https://cdn.example.com/a.png" style="width:{size}px;height:{size}px">'
    assert sanitize_html(css, MID, allow_remote_images=True).trackers_blocked == 0


def test_tracker_blocking_can_be_switched_off() -> None:
    tag = '<img src="https://t.example.com/o.gif" width="1" height="1">'
    kept = sanitize_html(f"<p>x</p>{tag}", MID, allow_remote_images=True, block_trackers=False)
    assert kept.trackers_blocked == 0 and "t.example.com/o.gif" in kept.html