Improve and test html sanitisation

tests/unit_tests/data/html_sanitisation_test_cases.md

@@ -0,0 +1,84 @@
+# HTML Sanitisation Test Cases
+
+This file is in markdown not python for readability.
+
+Each test is a level 2 heading. The input and expected values are level 3 headings.
+
+The HTML to test is in triple backtick code blocks.
+
+Anything not in code blocks is a comment.
+
+## Test scripts removed
+
+The script is removed but the contents remain.
+
+### Input
+```html
+<script>alert("x")</script>
+<p>Hello</p>
+```
+### Result
+```html
+alert(&quot;x&quot;)
+<p>Hello</p>
+```
+## Test script in bold tag
+
+### Input
+```html
+<b onmouseover=alert('Wufff!')>click me!</b>
+```
+### Result
+```html
+<b>click me!</b>
+```
+
+## Test script in disallowed tag
+### Input
+```html
+<img src="http://url.to.file.which/not.exist" onerror=alert(document.cookie);>
+```
+### Result
+```html
+```
+
+## Test cookie grabber script is escaped
+The script should become escaped and have no tags
+### Input
+```html
+<SCRIPT type="text/javascript">
+var adr = '../evil.php?cakemonster=' + escape(document.cookie);
+</SCRIPT>
+```
+### Result
+```html
+var adr = &#x27;../evil.php?cakemonster=&#x27; + escape(document.cookie);
+```
+
+## Test with non-http links
+Remove the javascript from the links.
+### Input
+```html
+<a href="javascript:alert(1)">link</a>
+<a href="javas&#99;ript:alert(1)">encoded</a>
+<a href="mailto:spammy@spam.com">Email</a>
+<a href="/a/relateive/link">Relative</a>
+```
+### Result
+```html
+<a>link</a>
+<a>encoded</a>
+<a>Email</a>
+<a>Relative</a>
+```
+
+## Test http links become external
+Remove the javascript from the links.
+### Input
+```html
+<a href="https://openflexure.org">OpenFlexure</a>
+```
+### Result
+```html
+<a href="https://openflexure.org" target="_blank" rel="noopener noreferrer">OpenFlexure</a>
+```

tests/unit_tests/test_ui.py

@@ -0,0 +1,24 @@
+"""Testing the server specified user interface."""
+
+import os
+
+import pytest
+
+from openflexure_microscope_server import ui
+
+from ..shared_utils.md_test_cases import find_test_cases
+
+THIS_DIR = os.path.dirname(os.path.abspath(__file__))
+HTML_SANITISATION_TEST_FILE = os.path.join(
+    THIS_DIR, "data", "html_sanitisation_test_cases.md"
+)
+HTML_SANITISATION_TEST_CASES = find_test_cases(HTML_SANITISATION_TEST_FILE, "html")
+
+
+@pytest.mark.parametrize("test_case", HTML_SANITISATION_TEST_CASES)
+def test_html_block_sanitises(test_case):
+    """Check each case in the test case file sanitises as expected."""
+    sanitised = ui.sanitise_html(test_case.input_code).strip()
+    assert sanitised == test_case.result_code, (
+        f"Test case: '{test_case.title}': Input code doesn't sanitise as expected."
+    )