public function XssTest::providerTestFilterXssNotNormalized in Drupal 9
Same name and namespace in other branches
- 8 core/tests/Drupal/Tests/Component/Utility/XssTest.php \Drupal\Tests\Component\Utility\XssTest::providerTestFilterXssNotNormalized()
Data provider for testFilterXssNotNormalized().
Return value
array An array of arrays containing the following elements:
- The value to filter.
- The value to expect that's missing after filtering.
- The assertion message.
- (optional) The allowed HTML HTML tags array that should be passed to \Drupal\Component\Utility\Xss::filter().
See also
testFilterXssNotNormalized()
File
- core/
tests/ Drupal/ Tests/ Component/ Utility/ XssTest.php, line 159
Class
- XssTest
- XSS Filtering tests.
Namespace
Drupal\Tests\Component\UtilityCode
public function providerTestFilterXssNotNormalized() {
$cases = [
// Tag stripping, different ways to work around removal of HTML tags.
[
'<script>alert(0)</script>',
'script',
'HTML tag stripping -- simple script without special characters.',
],
[
'<script src="http://www.example.com" />',
'script',
'HTML tag stripping -- empty script with source.',
],
[
'<ScRipt sRc=http://www.example.com/>',
'script',
'HTML tag stripping evasion -- varying case.',
],
[
"<script\nsrc\n=\nhttp://www.example.com/\n>",
'script',
'HTML tag stripping evasion -- multiline tag.',
],
[
'<script/a src=http://www.example.com/a.js></script>',
'script',
'HTML tag stripping evasion -- non whitespace character after tag name.',
],
[
'<script/src=http://www.example.com/a.js></script>',
'script',
'HTML tag stripping evasion -- no space between tag and attribute.',
],
// Null between < and tag name works at least with IE6.
[
"<\0scr\0ipt>alert(0)</script>",
'ipt',
'HTML tag stripping evasion -- breaking HTML with nulls.',
],
[
"<scrscriptipt src=http://www.example.com/a.js>",
'script',
'HTML tag stripping evasion -- filter just removing "script".',
],
[
'<<script>alert(0);//<</script>',
'script',
'HTML tag stripping evasion -- double opening brackets.',
],
[
'<script src=http://www.example.com/a.js?<b>',
'script',
'HTML tag stripping evasion -- no closing tag.',
],
// DRUPAL-SA-2008-047: This doesn't seem exploitable, but the filter should
// work consistently.
[
'<script>>',
'script',
'HTML tag stripping evasion -- double closing tag.',
],
[
'<script src=//www.example.com/.a>',
'script',
'HTML tag stripping evasion -- no scheme or ending slash.',
],
[
'<script src=http://www.example.com/.a',
'script',
'HTML tag stripping evasion -- no closing bracket.',
],
[
'<script src=http://www.example.com/ <',
'script',
'HTML tag stripping evasion -- opening instead of closing bracket.',
],
[
'<nosuchtag attribute="newScriptInjectionVector">',
'nosuchtag',
'HTML tag stripping evasion -- unknown tag.',
],
[
'<t:set attributeName="innerHTML" to="<script defer>alert(0)</script>">',
't:set',
'HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).',
],
[
'<img """><script>alert(0)</script>',
'script',
'HTML tag stripping evasion -- a malformed image tag.',
[
'img',
],
],
[
'<blockquote><script>alert(0)</script></blockquote>',
'script',
'HTML tag stripping evasion -- script in a blockquote.',
[
'blockquote',
],
],
[
"<!--[if true]><script>alert(0)</script><![endif]-->",
'script',
'HTML tag stripping evasion -- script within a comment.',
],
// Dangerous attributes removal.
[
'<p onmouseover="http://www.example.com/">',
'onmouseover',
'HTML filter attributes removal -- events, no evasion.',
[
'p',
],
],
[
'<li style="list-style-image: url(javascript:alert(0))">',
'style',
'HTML filter attributes removal -- style, no evasion.',
[
'li',
],
],
[
'<img onerror =alert(0)>',
'onerror',
'HTML filter attributes removal evasion -- spaces before equals sign.',
[
'img',
],
],
[
'<img onabort!#$%&()*~+-_.,:;?@[/|\\]^`=alert(0)>',
'onabort',
'HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.',
[
'img',
],
],
[
'<img oNmediAError=alert(0)>',
'onmediaerror',
'HTML filter attributes removal evasion -- varying case.',
[
'img',
],
],
// Works at least with IE6.
[
"<img o\0nfocus\0=alert(0)>",
'focus',
'HTML filter attributes removal evasion -- breaking with nulls.',
[
'img',
],
],
// Only whitelisted scheme names allowed in attributes.
[
'<img src="javascript:alert(0)">',
'javascript',
'HTML scheme clearing -- no evasion.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- no quotes.',
[
'img',
],
],
// A bit like CVE-2006-0070.
[
'<img src="javascript:confirm(0)">',
'javascript',
'HTML scheme clearing evasion -- no alert ;)',
[
'img',
],
],
[
'<img src=`javascript:alert(0)`>',
'javascript',
'HTML scheme clearing evasion -- grave accents.',
[
'img',
],
],
[
'<img dynsrc="javascript:alert(0)">',
'javascript',
'HTML scheme clearing -- rare attribute.',
[
'img',
],
],
[
'<table background="javascript:alert(0)">',
'javascript',
'HTML scheme clearing -- another tag.',
[
'table',
],
],
[
'<base href="javascript:alert(0);//">',
'javascript',
'HTML scheme clearing -- one more attribute and tag.',
[
'base',
],
],
[
'<img src="jaVaSCriPt:alert(0)">',
'javascript',
'HTML scheme clearing evasion -- varying case.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- UTF-8 decimal encoding.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- long UTF-8 encoding.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- UTF-8 hex encoding.',
[
'img',
],
],
[
"<img src=\"jav\tascript:alert(0)\">",
'script',
'HTML scheme clearing evasion -- an embedded tab.',
[
'img',
],
],
[
'<img src="jav	ascript:alert(0)">',
'script',
'HTML scheme clearing evasion -- an encoded, embedded tab.',
[
'img',
],
],
[
'<img src="jav
ascript:alert(0)">',
'script',
'HTML scheme clearing evasion -- an encoded, embedded newline.',
[
'img',
],
],
// With 
 this test would fail, but the entity gets turned into
// &#xD;, so it's OK.
[
'<img src="jav
ascript:alert(0)">',
'script',
'HTML scheme clearing evasion -- an encoded, embedded carriage return.',
[
'img',
],
],
[
"<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">",
'cript',
'HTML scheme clearing evasion -- broken into many lines.',
[
'img',
],
],
[
"<img src=\"jav\0a\0\0cript:alert(0)\">",
'cript',
'HTML scheme clearing evasion -- embedded nulls.',
[
'img',
],
],
[
'<img src="vbscript:msgbox(0)">',
'vbscript',
'HTML scheme clearing evasion -- another scheme.',
[
'img',
],
],
[
'<img src="nosuchscheme:notice(0)">',
'nosuchscheme',
'HTML scheme clearing evasion -- unknown scheme.',
[
'img',
],
],
// Netscape 4.x javascript entities.
[
'<br size="&{alert(0)}">',
'alert',
'Netscape 4.x javascript entities.',
[
'br',
],
],
// DRUPAL-SA-2008-006: Invalid UTF-8, these only work as reflected XSS with
// Internet Explorer 6.
[
"",
'style',
'HTML filter -- invalid UTF-8.',
[
'p',
],
],
];
// @todo This dataset currently fails under 5.4 because of
// https://www.drupal.org/node/1210798. Restore after its fixed.
if (version_compare(PHP_VERSION, '5.4.0', '<')) {
$cases[] = [
'<img src="  javascript:alert(0)">',
'javascript',
'HTML scheme clearing evasion -- spaces and metacharacters before scheme.',
[
'img',
],
];
}
return $cases;
}