summaryrefslogtreecommitdiff
path: root/tests/MailFunc.php
diff options
context:
space:
mode:
Diffstat (limited to 'tests/MailFunc.php')
-rw-r--r--tests/MailFunc.php14
1 files changed, 14 insertions, 0 deletions
diff --git a/tests/MailFunc.php b/tests/MailFunc.php
index 967277c2a..4d4250c22 100644
--- a/tests/MailFunc.php
+++ b/tests/MailFunc.php
@@ -97,6 +97,20 @@ class MailFunc extends PHPUnit_Framework_TestCase
}
/**
+ * Test the elimination of some XSS vulnerabilities
+ */
+ function test_html_xss3()
+ {
+ // #1488850
+ $html = '<p><a href="data:text/html,&lt;script&gt;alert(document.cookie)&lt;/script&gt;">Firefox</a>'
+ .'<a href="vbscript:alert(document.cookie)">Internet Explorer</a></p>';
+ $washed = rcmail_wash_html($html, array('safe' => true), array());
+
+ $this->assertNotRegExp('/data:text/', $washed, "Remove data:text/html links");
+ $this->assertNotRegExp('/vbscript:/', $washed, "Remove vbscript: links");
+ }
+
+ /**
* Test washtml class on non-unicode characters (#1487813)
*/
function test_washtml_utf8()