From 24d3767520341c946b53caa1041a9fb7ff0c9497 Mon Sep 17 00:00:00 2001 From: Michael Ganss Date: Thu, 11 Feb 2016 16:53:54 +0100 Subject: [PATCH] Force input HTML into body --- HtmlSanitizer.Tests/Tests.cs | 46 +++++++++++++++++++++++++++++++--- HtmlSanitizer/HtmlSanitizer.cs | 2 +- 2 files changed, 43 insertions(+), 5 deletions(-) diff --git a/HtmlSanitizer.Tests/Tests.cs b/HtmlSanitizer.Tests/Tests.cs index 4797e8d..34268ff 100644 --- a/HtmlSanitizer.Tests/Tests.cs +++ b/HtmlSanitizer.Tests/Tests.cs @@ -479,7 +479,7 @@ public void ImageHalfOpenHtmlXSSTest() string actual = sanitizer.Sanitize(htmlFragment); // Assert - string expected = ""; + string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); } @@ -493,13 +493,12 @@ public void ImageDoubleOpenAngleBracketXSSTest() // Arrange var sanitizer = new HtmlSanitizer(); - // Act string htmlFragment = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); } @@ -976,7 +975,7 @@ public void XmlNamespaceXSSTest() // Act - string htmlFragment = " XSS"; + string htmlFragment = "XSS"; string actual = sanitizer.Sanitize(htmlFragment); // Assert @@ -2449,6 +2448,45 @@ public void RemoveEventForNotAllowedUrlAtStyle() Assert.That(actual, Is.EqualTo(RemoveReason.NotAllowedUrlValue)); } + + [Test] + public void RemoveEventForNotAllowedTag_ScriptTag() + { + RemoveReason? actual = null; + var s = new HtmlSanitizer(); + s.RemovingTag += (sender, args) => + { + actual = args.Reason; + }; + s.Sanitize(""); + Assert.That(actual, Is.EqualTo(RemoveReason.NotAllowedTag)); + } + + [Test] + public void RemoveEventForNotAllowedTag_StyleTag() + { + RemoveReason? actual = null; + var s = new HtmlSanitizer(); + s.RemovingTag += (sender, args) => + { + actual = args.Reason; + }; + s.Sanitize(""); + Assert.That(actual, Is.EqualTo(RemoveReason.NotAllowedTag)); + } + + [Test] + public void RemoveEventForNotAllowedTag_ScriptTagAndSpan() + { + RemoveReason? actual = null; + var s = new HtmlSanitizer(); + s.RemovingTag += (sender, args) => + { + actual = args.Reason; + }; + s.Sanitize("Hi"); + Assert.That(actual, Is.EqualTo(RemoveReason.NotAllowedTag)); + } } } diff --git a/HtmlSanitizer/HtmlSanitizer.cs b/HtmlSanitizer/HtmlSanitizer.cs index f675f1d..2bfe680 100644 --- a/HtmlSanitizer/HtmlSanitizer.cs +++ b/HtmlSanitizer/HtmlSanitizer.cs @@ -326,7 +326,7 @@ public string Sanitize(string html, string baseUrl = "", IMarkupFormatter output IsToleratingInvalidConstraints = true, IsToleratingInvalidValues = true })); - var dom = parser.Parse(html); + var dom = parser.Parse("" + html + ""); // remove non-whitelisted tags foreach (var tag in dom.Body.QuerySelectorAll("*").Where(t => !IsAllowedTag(t)).ToList())