public function XssTest::providerTestFilterXssNotNormalized

Data provider for testFilterXssNotNormalized().

Return value

array An array of arrays containing the following elements:

• The value to filter string.
• The value to expect after filtering string.
• The assertion message string.
• (optional) The allowed html tags array that should be passed to Xss::filter().

See also

testFilterXssNotNormalized()

File

drupal/core/tests/Drupal/Tests/Component/Utility/XssTest.php, line 149

Contains \Drupal\Tests\Component\Utility\XssTest.

Class

XssTest

Tests the Xss utility.

Namespace

Code

public function providerTestFilterXssNotNormalized() {
  $cases = array(
    // Tag stripping, different ways to work around removal of HTML tags.
    array(
      '<script>alert(0)</script>',
      'script',
      'HTML tag stripping -- simple script without special characters.',
    ),
    array(
      '<script src="http://www.example.com" />',
      'script',
      'HTML tag stripping -- empty script with source.',
    ),
    array(
      '<ScRipt sRc=http://www.example.com/>',
      'script',
      'HTML tag stripping evasion -- varying case.',
    ),
    array(
      "<script\nsrc\n=\nhttp://www.example.com/\n>",
      'script',
      'HTML tag stripping evasion -- multiline tag.',
    ),
    array(
      '<script/a src=http://www.example.com/a.js></script>',
      'script',
      'HTML tag stripping evasion -- non whitespace character after tag name.',
    ),
    array(
      '<script/src=http://www.example.com/a.js></script>',
      'script',
      'HTML tag stripping evasion -- no space between tag and attribute.',
    ),
    // Null between < and tag name works at least with IE6.
    array(
      "<\0scr\0ipt>alert(0)</script>",
      'ipt',
      'HTML tag stripping evasion -- breaking HTML with nulls.',
    ),
    array(
      "<scrscriptipt src=http://www.example.com/a.js>",
      'script',
      'HTML tag stripping evasion -- filter just removing "script".',
    ),
    array(
      '<<script>alert(0);//<</script>',
      'script',
      'HTML tag stripping evasion -- double opening brackets.',
    ),
    array(
      '<script src=http://www.example.com/a.js?<b>',
      'script',
      'HTML tag stripping evasion -- no closing tag.',
    ),
    // DRUPAL-SA-2008-047: This doesn't seem exploitable, but the filter should
    // work consistently.
    array(
      '<script>>',
      'script',
      'HTML tag stripping evasion -- double closing tag.',
    ),
    array(
      '<script src=//www.example.com/.a>',
      'script',
      'HTML tag stripping evasion -- no scheme or ending slash.',
    ),
    array(
      '<script src=http://www.example.com/.a',
      'script',
      'HTML tag stripping evasion -- no closing bracket.',
    ),
    array(
      '<script src=http://www.example.com/ <',
      'script',
      'HTML tag stripping evasion -- opening instead of closing bracket.',
    ),
    array(
      '<nosuchtag attribute="newScriptInjectionVector">',
      'nosuchtag',
      'HTML tag stripping evasion -- unknown tag.',
    ),
    array(
      '<t:set attributeName="innerHTML" to="&lt;script defer&gt;alert(0)&lt;/script&gt;">',
      't:set',
      'HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).',
    ),
    array(
      '<img """><script>alert(0)</script>',
      'script',
      'HTML tag stripping evasion -- a malformed image tag.',
      array(
        'img',
      ),
    ),
    array(
      '<blockquote><script>alert(0)</script></blockquote>',
      'script',
      'HTML tag stripping evasion -- script in a blockqoute.',
      array(
        'blockquote',
      ),
    ),
    array(
      "<!--[if true]><script>alert(0)</script><![endif]-->",
      'script',
      'HTML tag stripping evasion -- script within a comment.',
    ),
    // Dangerous attributes removal.
    array(
      '<p onmouseover="http://www.example.com/">',
      'onmouseover',
      'HTML filter attributes removal -- events, no evasion.',
      array(
        'p',
      ),
    ),
    array(
      '<li style="list-style-image: url(javascript:alert(0))">',
      'style',
      'HTML filter attributes removal -- style, no evasion.',
      array(
        'li',
      ),
    ),
    array(
      '<img onerror   =alert(0)>',
      'onerror',
      'HTML filter attributes removal evasion -- spaces before equals sign.',
      array(
        'img',
      ),
    ),
    array(
      '<img onabort!#$%&()*~+-_.,:;?@[/|\\]^`=alert(0)>',
      'onabort',
      'HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.',
      array(
        'img',
      ),
    ),
    array(
      '<img oNmediAError=alert(0)>',
      'onmediaerror',
      'HTML filter attributes removal evasion -- varying case.',
      array(
        'img',
      ),
    ),
    // Works at least with IE6.
    array(
      "<img o\0nfocus\0=alert(0)>",
      'focus',
      'HTML filter attributes removal evasion -- breaking with nulls.',
      array(
        'img',
      ),
    ),
    // Only whitelisted scheme names allowed in attributes.
    array(
      '<img src="javascript:alert(0)">',
      'javascript',
      'HTML scheme clearing -- no evasion.',
      array(
        'img',
      ),
    ),
    array(
      '<img src=javascript:alert(0)>',
      'javascript',
      'HTML scheme clearing evasion -- no quotes.',
      array(
        'img',
      ),
    ),
    // A bit like CVE-2006-0070.
    array(
      '<img src="javascript:confirm(0)">',
      'javascript',
      'HTML scheme clearing evasion -- no alert ;)',
      array(
        'img',
      ),
    ),
    array(
      '<img src=`javascript:alert(0)`>',
      'javascript',
      'HTML scheme clearing evasion -- grave accents.',
      array(
        'img',
      ),
    ),
    array(
      '<img dynsrc="javascript:alert(0)">',
      'javascript',
      'HTML scheme clearing -- rare attribute.',
      array(
        'img',
      ),
    ),
    array(
      '<table background="javascript:alert(0)">',
      'javascript',
      'HTML scheme clearing -- another tag.',
      array(
        'table',
      ),
    ),
    array(
      '<base href="javascript:alert(0);//">',
      'javascript',
      'HTML scheme clearing -- one more attribute and tag.',
      array(
        'base',
      ),
    ),
    array(
      '<img src="jaVaSCriPt:alert(0)">',
      'javascript',
      'HTML scheme clearing evasion -- varying case.',
      array(
        'img',
      ),
    ),
    array(
      '<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#48;&#41;>',
      'javascript',
      'HTML scheme clearing evasion -- UTF-8 decimal encoding.',
      array(
        'img',
      ),
    ),
    array(
      '<img src=&#00000106&#0000097&#00000118&#0000097&#00000115&#0000099&#00000114&#00000105&#00000112&#00000116&#0000058&#0000097&#00000108&#00000101&#00000114&#00000116&#0000040&#0000048&#0000041>',
      'javascript',
      'HTML scheme clearing evasion -- long UTF-8 encoding.',
      array(
        'img',
      ),
    ),
    array(
      '<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x30&#x29>',
      'javascript',
      'HTML scheme clearing evasion -- UTF-8 hex encoding.',
      array(
        'img',
      ),
    ),
    array(
      "<img src=\"jav\tascript:alert(0)\">",
      'script',
      'HTML scheme clearing evasion -- an embedded tab.',
      array(
        'img',
      ),
    ),
    array(
      '<img src="jav&#x09;ascript:alert(0)">',
      'script',
      'HTML scheme clearing evasion -- an encoded, embedded tab.',
      array(
        'img',
      ),
    ),
    array(
      '<img src="jav&#x000000A;ascript:alert(0)">',
      'script',
      'HTML scheme clearing evasion -- an encoded, embedded newline.',
      array(
        'img',
      ),
    ),
    // With &#xD; this test would fail, but the entity gets turned into
    // &amp;#xD;, so it's OK.
    array(
      '<img src="jav&#x0D;ascript:alert(0)">',
      'script',
      'HTML scheme clearing evasion -- an encoded, embedded carriage return.',
      array(
        'img',
      ),
    ),
    array(
      "<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">",
      'cript',
      'HTML scheme clearing evasion -- broken into many lines.',
      array(
        'img',
      ),
    ),
    array(
      "<img src=\"jav\0a\0\0cript:alert(0)\">",
      'cript',
      'HTML scheme clearing evasion -- embedded nulls.',
      array(
        'img',
      ),
    ),
    array(
      '<img src="vbscript:msgbox(0)">',
      'vbscript',
      'HTML scheme clearing evasion -- another scheme.',
      array(
        'img',
      ),
    ),
    array(
      '<img src="nosuchscheme:notice(0)">',
      'nosuchscheme',
      'HTML scheme clearing evasion -- unknown scheme.',
      array(
        'img',
      ),
    ),
    // Netscape 4.x javascript entities.
    array(
      '<br size="&{alert(0)}">',
      'alert',
      'Netscape 4.x javascript entities.',
      array(
        'br',
      ),
    ),
    // DRUPAL-SA-2008-006: Invalid UTF-8, these only work as reflected XSS with
    // Internet Explorer 6.
    array(
      "",
      'style',
      'HTML filter -- invalid UTF-8.',
      array(
        'p',
      ),
    ),
  );

  // @fixme This dataset currently fails under 5.4 because of
  //   https://drupal.org/node/1210798 . Restore after its fixed.
  if (version_compare(PHP_VERSION, '5.4.0', '<')) {
    $cases[] = array(
      '<img src=" &#14;  javascript:alert(0)">',
      'javascript',
      'HTML scheme clearing evasion -- spaces and metacharacters before scheme.',
      array(
        'img',
      ),
    );
  }
  return $cases;
}