diff options
author | Thomas Bruederli <thomas@roundcube.net> | 2012-09-05 16:17:56 +0200 |
---|---|---|
committer | Thomas Bruederli <thomas@roundcube.net> | 2012-09-05 16:17:56 +0200 |
commit | ba3cd80c0c61e679cef92a1f4f51e645090a1472 (patch) | |
tree | 4bd7c352dade0d18c19f25d65b04a5b896813918 /tests/modcss.php | |
parent | 957ac142e3c80db3b86df4f0db3b82cfa8856206 (diff) | |
parent | e263994adc3f8f331c6167da1665c1920a5142f9 (diff) |
Merge branch 'master' of github.com:roundcube/roundcubemail
Diffstat (limited to 'tests/modcss.php')
-rw-r--r-- | tests/modcss.php | 45 |
1 files changed, 0 insertions, 45 deletions
diff --git a/tests/modcss.php b/tests/modcss.php deleted file mode 100644 index 945cac318..000000000 --- a/tests/modcss.php +++ /dev/null @@ -1,45 +0,0 @@ -<?php - -/** - * Test class to test rcmail_mod_css_styles and XSS vulnerabilites - * - * @package Tests - */ -class rcube_test_modcss extends UnitTestCase -{ - - function __construct() - { - $this->UnitTestCase('CSS modification and vulnerability tests'); - } - - function test_modcss() - { - $css = file_get_contents(TESTS_DIR . 'src/valid.css'); - $mod = rcmail_mod_css_styles($css, 'rcmbody'); - - $this->assertPattern('/#rcmbody\s+\{/', $mod, "Replace body style definition"); - $this->assertPattern('/#rcmbody h1\s\{/', $mod, "Prefix tag styles (single)"); - $this->assertPattern('/#rcmbody h1, #rcmbody h2, #rcmbody h3, #rcmbody textarea\s+\{/', $mod, "Prefix tag styles (multiple)"); - $this->assertPattern('/#rcmbody \.noscript\s+\{/', $mod, "Prefix class styles"); - } - - function test_xss() - { - $mod = rcmail_mod_css_styles("body.main2cols { background-image: url('../images/leftcol.png'); }", 'rcmbody'); - $this->assertEqual("/* evil! */", $mod, "No url() values allowed"); - - $mod = rcmail_mod_css_styles("@import url('http://localhost/somestuff/css/master.css');", 'rcmbody'); - $this->assertEqual("/* evil! */", $mod, "No import statements"); - - $mod = rcmail_mod_css_styles("left:expression(document.body.offsetWidth-20)", 'rcmbody'); - $this->assertEqual("/* evil! */", $mod, "No expression properties"); - - $mod = rcmail_mod_css_styles("left:exp/* */ression( alert('xss3') )", 'rcmbody'); - $this->assertEqual("/* evil! */", $mod, "Don't allow encoding quirks"); - - $mod = rcmail_mod_css_styles("background:\\0075\\0072\\006c( javascript:alert('xss') )", 'rcmbody'); - $this->assertEqual("/* evil! */", $mod, "Don't allow encoding quirks (2)"); - } - -} |