Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merge branch 'main' of https://github.com/cure53/DOMPurify into main #464

Merged
merged 4 commits into from Sep 3, 2020
Merged

Merge branch 'main' of https://github.com/cure53/DOMPurify into main #464

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a0499ba
Update jsdom to version 16.x.x
peernohell Sep 2, 2020
eca5522
Merge branch 'main' of https://github.com/cure53/DOMPurify into main
peernohell Sep 2, 2020
65523f7
update yarn.lock file
peernohell Sep 2, 2020
1727266
add VirtualConsole to hide jsdom warning
peernohell Sep 2, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Expand Up @@ -69,7 +69,7 @@
"eslint-plugin-prettier": "^3.1.3",
"he": "^1.2.0",
"jquery": "^3.5.0",
"jsdom": "8.x.x",
"jsdom": "16.x.x",
"karma": "^5.1.0",
"karma-browserstack-launcher": "^1.5.1",
"karma-chrome-launcher": "^2.2.0",
Expand Down
59 changes: 30 additions & 29 deletions test/bootstrap-test-suite.js
View file
Open in desktop
@@ -1,4 +1,6 @@
module.exports = function (jsdom) {
const fs = require('fs');

module.exports = function (JSDOM) {
class StringWrapper {
constructor(s) {
this.s = s;
Expand All @@ -9,40 +11,39 @@ module.exports = function (jsdom) {
}
}

function loadDOMPurify(assert, head, setup, onload) {
function loadDOMPurify(assert, addScriptAttribute, setup, onload) {
const testDone = assert.async();
jsdom.env({
html: '<head>' + head + '</head>',
features: {
FetchExternalResources: ['script'],
ProcessExternalResources: ['script'],
},
created(err, window) {
if (setup) {
setup(window);
}
},
done(err, window) {
assert.ok(window.DOMPurify.sanitize);
// Sanity check
assert.equal(
window.DOMPurify.sanitize('<img src=x onerror=alert(1)>'),
'<img src="x">'
);
if (onload) {
onload(window);
}
testDone();
},
});
const { window } = new JSDOM('<head></head>', { runScripts: "dangerously" });
require('jquery')(window);
if (setup) {
setup(window);
}

const myLibrary = fs.readFileSync('dist/purify.js', { encoding: "utf-8" });
const scriptEl = window.document.createElement("script");
if (addScriptAttribute) scriptEl.setAttribute('data-tt-policy-suffix', 'suffix');

scriptEl.textContent = myLibrary;
window.document.body.appendChild(scriptEl);

assert.ok(window.DOMPurify.sanitize);
// Sanity check
assert.equal(
window.DOMPurify.sanitize('<img src=x onerror=alert(1)>'),
'<img src="x">'
);
if (onload) {
onload(window);
}
testDone();
}

QUnit.test('works in a non-Trusted Type environment', function (assert) {
let policyCreated;

loadDOMPurify(
assert,
'<script src="dist/purify.js"></script>',
false,
function setup(window) {
delete window.trustedTypes;
},
Expand All @@ -58,7 +59,7 @@ module.exports = function (jsdom) {

loadDOMPurify(
assert,
'<script src="dist/purify.js"></script>',
false,
function setup(window) {
window.trustedTypes = {
createPolicy(name, rules) {
Expand Down Expand Up @@ -89,7 +90,7 @@ module.exports = function (jsdom) {

loadDOMPurify(
assert,
'<script data-tt-policy-suffix="suffix" src="dist/purify.js"></script>',
true,
function setup(window) {
window.trustedTypes = {
createPolicy(name, rules) {
Expand Down
70 changes: 29 additions & 41 deletions test/jsdom-node.js
View file
Open in desktop
Expand Up @@ -5,6 +5,11 @@
// Test DOMPurify + jsdom using Node.js (version 8 and up)
const createDOMPurify = require('../dist/purify.cjs');
const jsdom = require('jsdom');
const { JSDOM, VirtualConsole } = jsdom;
const virtualConsole = new VirtualConsole();
const { window } = new JSDOM(`<html><head></head><body><div id="qunit-fixture"></div></body></html>`, { runScripts: "dangerously", virtualConsole });
require('jquery')(window);

const sanitizeTestSuite = require('./test-suite');
const bootstrapTestSuite = require('./bootstrap-test-suite');
const tests = require('./fixtures/expect');
Expand All @@ -19,44 +24,27 @@ QUnit.assert.contains = function (needle, haystack, message) {

QUnit.config.autostart = false;

QUnit.module('DOMPurify - bootstrap', bootstrapTestSuite(jsdom));

jsdom.env({
html: `<html><head></head><body><div id="qunit-fixture"></div></body></html>`,
scripts: ['node_modules/jquery/dist/jquery.js'],
features: {
ProcessExternalResources: ['script'], // needed for firing the onload event for about:blank iframes
},
done(err, window) {
QUnit.module('DOMPurify in jsdom');
if (err) {
console.error(
'Unexpected error returned by jsdom.env():',
err,
err.stack
);
process.exit(1);
}

if (!window.jQuery) {
console.warn('Unable to load jQuery');
}

const DOMPurify = createDOMPurify(window);
if (!DOMPurify.isSupported) {
console.error(
'Unexpected error returned by jsdom.env():',
err,
err.stack
);
process.exit(1);
}

window.alert = () => {
window.xssed = true;
};

sanitizeTestSuite(DOMPurify, window, tests, xssTests);
QUnit.start();
},
});
QUnit.module('DOMPurify - bootstrap', bootstrapTestSuite(JSDOM));

QUnit.module('DOMPurify in jsdom');

if (!window.jQuery) {
console.warn('Unable to load jQuery');
}

const DOMPurify = createDOMPurify(window);
if (!DOMPurify.isSupported) {
console.error(
'Unexpected error returned by jsdom.env():',
err,
err.stack
);
process.exit(1);
}

window.alert = () => {
window.xssed = true;
};

sanitizeTestSuite(DOMPurify, window, tests, xssTests);
QUnit.start();