Micron Document
C.S.Burner 🪙 ━►🔥GIT Node

Node / reticulum_mirror / MeshChatX / files / tests / frontend / sanitizerXssOracle.test.js

Displaying Raw • Download

tests/frontend/sanitizerXssOracle.test.js 19079f5dd4e86cab6436cb46d86c0dcce8d66ecb (19079f5d) Text, 5.89 KB

T8b949e// SPDX-License-Identifier: 0BSD

T8b949e/**
* Shared XSS corpus against every HTML sanitizer the UI ships.
* Formatted markup may remain. Scriptable nodes and executable URLs must not.
*/

Tff7b72import Tb4b4b4{ Te6edf3describeTb4b4b4, Te6edf3expectTb4b4b4, Te6edf3it Tb4b4b4} Tff7b72from Ta5d6ff"vitest"Tb4b4b4;
Tff7b72import Te6edf3MarkdownRenderer Tff7b72from Ta5d6ff"@/js/MarkdownRenderer.js"Tb4b4b4;
Tff7b72import Te6edf3MicronParser Tff7b72from Ta5d6ff"@/js/MicronParser.js"Tb4b4b4;
Tff7b72import Tb4b4b4{
Te6edf3renderNomadHtmlPageTb4b4b4,
Te6edf3renderNomadMarkdownTb4b4b4,
Te6edf3sanitizeNomadHtmlDocumentTb4b4b4,
Te6edf3sanitizeNomadHtmlFragmentTb4b4b4,
Tb4b4b4} Tff7b72from Ta5d6ff"@/js/NomadPageRenderer.js"Tb4b4b4;
Tff7b72import Tb4b4b4{ Te6edf3sanitizeKmlText Tb4b4b4} Tff7b72from Ta5d6ff"@/js/mapExchange/kmlSanitize.js"Tb4b4b4;

Tff7b72export Tff7b72const Te6edf3XSS_PAYLOADS Tff7b72= Tb4b4b4[
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"javascript href"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<a href="javascript:alert(1)">x</a>' Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"javascript uppercase"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<a href="JAVASCRIPT:alert(1)">x</a>' Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"data html href"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<a href="data:text/html,<script>alert(1)</script>">x</a>' Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"base tag"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<base href="https://evil.example/"><p>ok</p>' Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"svg script"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff"<svg><script>alert(1)</script></svg><p>ok</p>" Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"svg onload"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<svg onload="alert(1)"></svg><p>ok</p>' Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"img onerror"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<img src=x onerror="alert(1)"><p>ok</p>' Tb4b4b4}Tb4b4b4,
Tb4b4b4{
Te6edf3nameTff7b72: Ta5d6ff"css url javascript"Tb4b4b4,
Te6edf3inputTff7b72: Ta5d6ff'<style>body{background:url("javascript:alert(1)")}</style><p>ok</p>'Tb4b4b4,
Tb4b4b4}Tb4b4b4,
Tb4b4b4{
Te6edf3nameTff7b72: Ta5d6ff"css url https"Tb4b4b4,
Te6edf3inputTff7b72: Ta5d6ff'<style>p{background:url("https://evil.example/x.png")}</style><p>ok</p>'Tb4b4b4,
Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"nested markdown js"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff"[x](javascript:alert(1))" Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"nested markdown image"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff"![x](javascript:alert(1))" Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"script tag"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff"<script>alert(1)</script><p>ok</p>" Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"iframe"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<iframe src="javascript:alert(1)"></iframe><p>ok</p>' Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"micron js link"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff"`[click`javascript:alert(1)]`" Tb4b4b4}Tb4b4b4,
Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"entity javascript href"Tb4b4b4, Te6edf3inputTff7b72: Ta5d6ff'<a href="&#106;avascript:alert(1)">x</a>' Tb4b4b4}Tb4b4b4,
Tb4b4b4]Tb4b4b4;

Tff7b72export Tff7b72function Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3htmlTb4b4b4, Te6edf3payloadNameTb4b4b4) Tb4b4b4{
Te6edf3expectTb4b4b4(Tff7b72typeof Te6edf3htmlTb4b4b4, Te6edf3payloadNameTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"string"Tb4b4b4)Tb4b4b4;
Tff7b72const Te6edf3doc Tff7b72= Tff7b72new Te6edf3DOMParserTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3parseFromStringTb4b4b4(Ta5d6ff`Ta5d6ff<div id="xss-root">Tffd700${Te6edf3htmlTffd700}Ta5d6ff</div>Ta5d6ff`Tb4b4b4, Ta5d6ff"text/html"Tb4b4b4)Tb4b4b4;
Tff7b72const Te6edf3root Tff7b72= Te6edf3docTb4b4b4.Te6edf3getElementByIdTb4b4b4(Ta5d6ff"xss-root"Tb4b4b4) Tff7b72|| Te6edf3docTb4b4b4.Te6edf3bodyTb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3rootTb4b4b4.Te6edf3querySelectorTb4b4b4(Ta5d6ff"script, iframe, object, embed, base"Tb4b4b4)Tb4b4b4, Te6edf3payloadNameTb4b4b4)Tb4b4b4.Te6edf3toBeNullTb4b4b4(Tb4b4b4)Tb4b4b4;
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3el Tff7b72of Te6edf3rootTb4b4b4.Te6edf3querySelectorAllTb4b4b4(Ta5d6ff"[href], [src]"Tb4b4b4)Tb4b4b4) Tb4b4b4{
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3attr Tff7b72of Tb4b4b4[Ta5d6ff"href"Tb4b4b4, Ta5d6ff"src"Tb4b4b4]Tb4b4b4) Tb4b4b4{
Tff7b72const Te6edf3v Tff7b72= Te6edf3elTb4b4b4.Te6edf3getAttributeTb4b4b4(Te6edf3attrTb4b4b4)Tb4b4b4;
Tff7b72if Tb4b4b4(Tff7b72!Te6edf3vTb4b4b4) Tb4b4b4{
Tff7b72continueTb4b4b4;
Tb4b4b4}
Tff7b72const Te6edf3lower Tff7b72= Te6edf3vTb4b4b4.Te6edf3trimTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"javascript:"Tb4b4b4)Tb4b4b4, Ta5d6ff`Tffd700${Te6edf3payloadNameTffd700}Ta5d6ff Tffd700${Te6edf3attrTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72falseTb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"vbscript:"Tb4b4b4)Tb4b4b4, Ta5d6ff`Tffd700${Te6edf3payloadNameTffd700}Ta5d6ff Tffd700${Te6edf3attrTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72falseTb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"data:text/html"Tb4b4b4)Tb4b4b4, Ta5d6ff`Tffd700${Te6edf3payloadNameTffd700}Ta5d6ff Tffd700${Te6edf3attrTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72falseTb4b4b4)Tb4b4b4;
Tb4b4b4}
Tb4b4b4}
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3el Tff7b72of Te6edf3rootTb4b4b4.Te6edf3querySelectorAllTb4b4b4(Ta5d6ff"*"Tb4b4b4)Tb4b4b4) Tb4b4b4{
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3attr Tff7b72of Tb4b4b4[Tb4b4b4...Te6edf3elTb4b4b4.Te6edf3attributesTb4b4b4]Tb4b4b4) Tb4b4b4{
Te6edf3expectTb4b4b4(Te6edf3attrTb4b4b4.Te6edf3nameTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"on"Tb4b4b4)Tb4b4b4, Ta5d6ff`Tffd700${Te6edf3payloadNameTffd700}Ta5d6ff Tffd700${Te6edf3attrTb4b4b4.Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72falseTb4b4b4)Tb4b4b4;
Tb4b4b4}
Tb4b4b4}
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3styleEl Tff7b72of Te6edf3rootTb4b4b4.Te6edf3querySelectorAllTb4b4b4(Ta5d6ff"style"Tb4b4b4)Tb4b4b4) Tb4b4b4{
Tff7b72const Te6edf3css Tff7b72= Tb4b4b4(Te6edf3styleElTb4b4b4.Te6edf3textContent Tff7b72|| Ta5d6ff""Tb4b4b4)Tb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3cssTb4b4b4, Te6edf3payloadNameTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/url\s*\(\s*["']?\s*javascript:/Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3cssTb4b4b4, Te6edf3payloadNameTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/expression\s*\(/Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3el Tff7b72of Te6edf3rootTb4b4b4.Te6edf3querySelectorAllTb4b4b4(Ta5d6ff"[style]"Tb4b4b4)Tb4b4b4) Tb4b4b4{
Tff7b72const Te6edf3css Tff7b72= Tb4b4b4(Te6edf3elTb4b4b4.Te6edf3getAttributeTb4b4b4(Ta5d6ff"style"Tb4b4b4) Tff7b72|| Ta5d6ff""Tb4b4b4)Tb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3cssTb4b4b4, Te6edf3payloadNameTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/url\s*\(\s*["']?\s*javascript:/Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Tb4b4b4}

Tff7b72function Te6edf3wrapKmlTb4b4b4(Te6edf3innerTb4b4b4) Tb4b4b4{
Tff7b72return Ta5d6ff`Ta5d6ff<?xml version="1.0"?>
kml xmlns="http://www.opengis.net/kml/2.2"><Document>
Placemark><name>P</name>
description><![CDATA[Tffd700${Te6edf3innerTffd700}Ta5d6ff]]></description>
Point><coordinates>1,2,0</coordinates></Point>
/Placemark></Document></kml>Ta5d6ff`Tb4b4b4;
Tb4b4b4}

Te6edf3describeTb4b4b4(Ta5d6ff"shared XSS sanitizer oracles"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Te6edf3itTb4b4b4(Ta5d6ff"MarkdownRenderer never emits a scriptable node"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72for Tb4b4b4(Tff7b72const Tb4b4b4{ Te6edf3nameTb4b4b4, Te6edf3input Tb4b4b4} Tff7b72of Te6edf3XSS_PAYLOADSTb4b4b4) Tb4b4b4{
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3MarkdownRendererTb4b4b4.Te6edf3renderTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6ffrender Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3MarkdownRendererTb4b4b4.Te6edf3renderBasicTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6ffrenderBasic Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"Nomad HTML and markdown sanitizers never emit a scriptable node"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72for Tb4b4b4(Tff7b72const Tb4b4b4{ Te6edf3nameTb4b4b4, Te6edf3input Tb4b4b4} Tff7b72of Te6edf3XSS_PAYLOADSTb4b4b4) Tb4b4b4{
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3sanitizeNomadHtmlFragmentTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6fffragment Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3sanitizeNomadHtmlDocumentTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6ffdocument Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3renderNomadHtmlPageTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6ffhtml page Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3renderNomadMarkdownTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6ffmarkdown Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"MicronParser never emits a scriptable node"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72const Te6edf3parser Tff7b72= Tff7b72new Te6edf3MicronParserTb4b4b4(Tff7b72trueTb4b4b4, Tff7b72falseTb4b4b4)Tb4b4b4;
Tff7b72for Tb4b4b4(Tff7b72const Tb4b4b4{ Te6edf3nameTb4b4b4, Te6edf3input Tb4b4b4} Tff7b72of Te6edf3XSS_PAYLOADSTb4b4b4) Tb4b4b4{
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3MicronParserTb4b4b4.Te6edf3sanitizeRenderedMicronHtmlTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6ffsanitize Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3parserTb4b4b4.Te6edf3convertMicronToHtmlTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4, Ta5d6ff`Ta5d6ffconvert Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"Micron overlay scrub strips unquoted position:fixed"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72const Te6edf3html Tff7b72= Te6edf3MicronParserTb4b4b4.Te6edf3sanitizeRenderedMicronHtmlTb4b4b4(Ta5d6ff"<div style=position:fixed;top:0;width:100%>tap</div>"Tb4b4b4)Tb4b4b4;
Tff7b72const Te6edf3lower Tff7b72= Te6edf3htmlTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/position\s*:\s*fixed/Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"KML sanitizer never emits a scriptable node"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72for Tb4b4b4(Tff7b72const Tb4b4b4{ Te6edf3nameTb4b4b4, Te6edf3input Tb4b4b4} Tff7b72of Te6edf3XSS_PAYLOADSTb4b4b4) Tb4b4b4{
Tff7b72const Te6edf3out Tff7b72= Te6edf3sanitizeKmlTextTb4b4b4(Te6edf3wrapKmlTb4b4b4(Te6edf3inputTb4b4b4)Tb4b4b4)Tb4b4b4;
Te6edf3assertNoScriptableHtmlTb4b4b4(Te6edf3outTb4b4b4.Te6edf3textTb4b4b4, Ta5d6ff`Ta5d6ffkml Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;
Tff7b72const Te6edf3lower Tff7b72= Te6edf3outTb4b4b4.Te6edf3textTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4, Ta5d6ff`Ta5d6ffkml href Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/<href>\s*(javascript:|vbscript:|data:text\/html)/Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4, Ta5d6ff`Ta5d6ffkml xlink Tffd700${Te6edf3nameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/xlink:href\s*=\s*["']?\s*javascript:/Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Tb4b4b4}Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Served by rngit 1.5.4 - Generated in 0.02s