openflexure-microscope-server/tests/unit_tests/data/html_sanitisation_test_cases.md

HTML Sanitisation Test Cases

This file is in markdown not python for readability.

Each test is a level 2 heading. The input and expected values are level 3 headings.

The HTML to test is in triple backtick code blocks.

Anything not in code blocks is a comment.

This file is run by /tests/unit_tests/test_ui.py

Test scripts removed

The script is removed but the contents remain.

Input

<script>alert("x")</script>
<p>Hello</p>

Result

alert("x")
Hello

Test script in bold tag

Input

<b onmouseover=alert('Wufff!')>click me!</b>

Result

<b>click me!</b>

Test script in disallowed tag

Input

<img src="http://url.to.file.which/not.exist" onerror=alert(document.cookie);>

Result

Test cookie grabber script is escaped

The script should become escaped and have no tags

Input

<SCRIPT type="text/javascript">
var adr = '../evil.php?cakemonster=' + escape(document.cookie);
</SCRIPT>

Result

var adr = '../evil.php?cakemonster=' + escape(document.cookie);

Test with non-http links

Remove the javascript from the links.

Input

<a href="javascript:alert(1)">link</a>
<a href="javas&#99;ript:alert(1)">encoded</a>
<a href="mailto:spammy@spam.com">Email</a>
<a href="/a/relateive/link">Relative</a>

Result

<a>link</a>
<a>encoded</a>
<a>Email</a>
<a>Relative</a>

Test http links become external

Remove the javascript from the links.

Input

<a href="https://openflexure.org">OpenFlexure</a>

Result

<a href="https://openflexure.org" target="_blank" rel="noopener noreferrer">OpenFlexure</a>

Test basic formatting preserved

Check basic elements are not changed

Input

This is <b>bold</b> <i>italic</i> and on a new <br/> line.

Result

This is <b>bold</b> <i>italic</i> and on a new <br/> line.

Test http link with path preserved

Valid HTTP links should preserve their path.

Input

<a href="https://example.com/docs/page">Docs</a>

Result

<a href="https://example.com/docs/page" target="_blank" rel="noopener noreferrer">Docs</a>

Test http link with fragment preserved

Valid HTTP links should preserve their path and fragment.

Input

<a href="https://example.com/docs/page#section">Docs Section</a>

Result

<a href="https://example.com/docs/page#section" target="_blank" rel="noopener noreferrer">Docs Section</a>