diff --git a/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html b/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html index c9ea8c416e32..bfa1fdf6c82a 100644 --- a/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html +++ b/dom/security/sanitizer/tests/mochitest/test_sanitizer_api.html @@ -52,23 +52,23 @@ SimpleTest.waitForExplicitFinish(); sanitizerOptions: {}, }, { - // test for the allowElements option + // test for the elements option testString: "
hello folks
", testExpected: "hello folks
", - sanitizerOptions: { allowElements: ["p"] }, + sanitizerOptions: { elements: ["p"] }, }, { - // test for the blockElements option + // test for the replaceWithChildrenElements option testString: "hello folks
", testExpected: "hello folks
", - sanitizerOptions: { blockElements: ["i"] }, + sanitizerOptions: { replaceWithChildrenElements: ["i"] }, }, // TODO: Unknown attributes aren't supported yet. // { // // test for the allowAttributes option // testString: `hello
`, // testExpected: `hello
`, - // sanitizerOptions: { allowUnknownMarkup: true, allowAttributes: { 'haha': ['p'] } }, + // sanitizerOptions: { unknownMarkup: true, attributes: ["haha"] }, // }, { // confirming the inverse @@ -77,10 +77,10 @@ SimpleTest.waitForExplicitFinish(); sanitizerOptions: {}, }, { - // test for the dropAttributes option + // test for the removeAttributes option testString: `hello
`, testExpected: `hello
`, - sanitizerOptions: { dropAttributes: [{name: 'title', elements: ['p']}] }, + sanitizerOptions: { removeAttributes: ['title'] }, }, { // confirming the inverse @@ -89,12 +89,12 @@ SimpleTest.waitForExplicitFinish(); sanitizerOptions: {}, }, { - // if an attribute is allowed and dropped, the drop will take preference + // if an attribute is allowed and removed, the remove will take preference testString: `hello
`, testExpected: `hello
`, sanitizerOptions: { - allowAttributes: [{ name: 'title', elements: ['p'] }], - dropAttributes: [{ name: 'title', elements: ['p'] }] + attributes: ["title"], + removeAttributes: ["title"], }, }, ]; @@ -123,7 +123,7 @@ SimpleTest.waitForExplicitFinish(); else { // test setHTML: try { - div.setHTML(testString, { sanitizer: testSanitizer }); + div.setHTML(testString, { sanitizer: sanitizerOptions }); is(div.innerHTML, testExpected, `div.setHTML() should turn(${testType}) '${testInput}' into '${testExpected}'`); } catch (e) { diff --git a/testing/web-platform/meta/sanitizer-api/element-set-sanitized-html.https.html.ini b/testing/web-platform/meta/sanitizer-api/element-set-sanitized-html.https.html.ini new file mode 100644 index 000000000000..2f3bcfc1c80a --- /dev/null +++ b/testing/web-platform/meta/sanitizer-api/element-set-sanitized-html.https.html.ini @@ -0,0 +1,3 @@ +[element-set-sanitized-html.https.html] + [Sanitizer: Element.setHTML with config: attributes: unknown attributes and with unknownMarkup] + expected: FAIL diff --git a/testing/web-platform/meta/sanitizer-api/sanitizer-names.https.html.ini b/testing/web-platform/meta/sanitizer-api/sanitizer-names.https.html.ini index d3dbbf64af51..d8f4a8db4848 100644 --- a/testing/web-platform/meta/sanitizer-api/sanitizer-names.https.html.ini +++ b/testing/web-platform/meta/sanitizer-api/sanitizer-names.https.html.ini @@ -1,22 +1,22 @@ [sanitizer-names.https.html] expected: if (os == "android") and fission: [OK, TIMEOUT] - [Element names in config item: allowElements] + [Element names in config item: elements] expected: FAIL - [Element names in config item: dropElements] + [Element names in config item: removeElements] expected: FAIL - [Element names in config item: blockElements] + [Element names in config item: replaceWithChildrenElements] expected: FAIL - [Attribute names in config item: allowAttributes] + [Attribute names in config item: attributes] expected: FAIL - [Attribute names in config item: dropAttributes] + [Attribute names in config item: removeAttributes] expected: FAIL - [Namespaced attributes #2: allowAttributes: [{"name":"xlink:href","elements":"*"}\]] + [Namespaced attributes #2: attributes: [{"name":"xlink:href"}\]] expected: FAIL [Lower-case element names #0: "svg:feblend"] diff --git a/testing/web-platform/meta/sanitizer-api/sanitizer-sanitize.https.tentative.html.ini b/testing/web-platform/meta/sanitizer-api/sanitizer-sanitize.https.tentative.html.ini index ffb0fb0b925b..d1cb7c271502 100644 --- a/testing/web-platform/meta/sanitizer-api/sanitizer-sanitize.https.tentative.html.ini +++ b/testing/web-platform/meta/sanitizer-api/sanitizer-sanitize.https.tentative.html.ini @@ -1,15 +1,15 @@ [sanitizer-sanitize.https.tentative.html] + max-asserts: 120 expected: if (os == "android") and fission: [OK, TIMEOUT] - max-asserts: 120 [SanitizerAPI with config: plaintext, sanitize from document function for ] expected: FAIL - [SanitizerAPI with config: allowAttributes unknown attributes and with allowUnknownMarkup, sanitize from document function for ] + [SanitizerAPI with config: attributes: unknown attributes and with unknownMarkup, sanitize from document function for ] expected: FAIL [SanitizerAPI with config: plaintext, sanitize from document fragment function for ] expected: FAIL - [SanitizerAPI with config: allowAttributes unknown attributes and with allowUnknownMarkup, sanitize from document fragment function for ] + [SanitizerAPI with config: attributes: unknown attributes and with unknownMarkup, sanitize from document fragment function for ] expected: FAIL diff --git a/testing/web-platform/meta/sanitizer-api/sanitizer-sanitizeFor.https.tentative.html.ini b/testing/web-platform/meta/sanitizer-api/sanitizer-sanitizeFor.https.tentative.html.ini index 777be86cc205..32dd6fc3c453 100644 --- a/testing/web-platform/meta/sanitizer-api/sanitizer-sanitizeFor.https.tentative.html.ini +++ b/testing/web-platform/meta/sanitizer-api/sanitizer-sanitizeFor.https.tentative.html.ini @@ -1,21 +1,51 @@ [sanitizer-sanitizeFor.https.tentative.html] expected: if (os == "android") and debug: [OK, TIMEOUT] + [Sanitizer.sanitizeFor("script", ...) should fail.] + expected: FAIL + + [Sanitizer.sanitizeFor("iframe", ...) should fail.] + expected: FAIL + + [Sanitizer.sanitizeFor("object", ...) should fail.] + expected: FAIL + + [Sanitizer.sanitizeFor("div", ...) should pass.] + expected: FAIL + + [Sanitizer.sanitizeFor function shouldn't load the image.] + expected: FAIL + [Sanitizer.sanitizeFor(element, ..)] expected: FAIL + [Sanitizer.sanitizeFor("div", "Hello") obeys parse context.] + expected: FAIL + + [Sanitizer.sanitizeFor("div", "attributes: ["title"\] and div attributes: ["id"\] lists] expected: FAIL - [Sanitizer.sanitizeFor with config: dropAttributes list {"data-attribute-with-dashes": ["*"\]} with dom dataset js access] + [Sanitizer.sanitizeFor with config: elements list with
removeAttributes: ["title"\] and div removeAttributes: ["id"\] lists] expected: FAIL - [Sanitizer.sanitizeFor with config: allowAttributes list {"id": ["div"\]} with id attribute] + [Sanitizer.sanitizeFor with config: elements list with div attributes: ["id"\] and removeAttributes: ["id"\] lists] expected: FAIL - [Sanitizer.sanitizeFor with config: allowAttributes list {"id": ["*"\]} with id attribute and onclick scripts] + [Sanitizer.sanitizeFor with config: attributes list ["id"\] with id attribute and onclick scripts] expected: FAIL - [Sanitizer.sanitizeFor with config: allowAttributes list has no influence to dropAttributes] + [Sanitizer.sanitizeFor with config: attributes list has no influence to removeAttributes list] expected: FAIL [Sanitizer.sanitizeFor with config: Template element] @@ -163,34 +205,19 @@ [Sanitizer.sanitizeFor with config: HTML with comments; comments not allowed] expected: FAIL - [Sanitizer.sanitizeFor with config: HTML with comments; allowComments] + [Sanitizer.sanitizeFor with config: HTML with comments; comments] expected: FAIL - [Sanitizer.sanitizeFor with config: HTML with comments; !allowComments] + [Sanitizer.sanitizeFor with config: HTML with comments; !comments] expected: FAIL [Sanitizer.sanitizeFor with config: HTML with comments deeper in the tree] expected: FAIL - [Sanitizer.sanitizeFor with config: HTML with comments deeper in the tree, allowComments] + [Sanitizer.sanitizeFor with config: HTML with comments deeper in the tree, comments] expected: FAIL - [Sanitizer.sanitizeFor with config: HTML with comments deeper in the tree, !allowComments] - expected: FAIL - - [Sanitizer.sanitizeFor("script", ...) should fail.] - expected: FAIL - - [Sanitizer.sanitizeFor("object", ...) should fail.] - expected: FAIL - - [Sanitizer.sanitizeFor("iframe", ...) should fail.] - expected: FAIL - - [Sanitizer.sanitizeFor with config: script not as root] - expected: FAIL - - [Sanitizer.sanitizeFor with config: script deeper in the tree] + [Sanitizer.sanitizeFor with config: HTML with comments deeper in the tree, !comments] expected: FAIL [Sanitizer.sanitizeFor with config: Unknown HTML names (HTMLUnknownElement instances) should not match elements parsed as non-HTML namespaces.] @@ -199,74 +226,62 @@ [Sanitizer.sanitizeFor with config: Unknown HTML names (HTMLUnknownElement instances) should not match elements parsed as non-HTML namespaces when nested.] expected: FAIL - [Sanitizer.sanitizeFor("div", ...) should pass.] + [Sanitizer.sanitizeFor with config: removeElements list ["I", "DL"\]}] expected: FAIL - [Sanitizer.sanitizeFor function shouldn't load the image.] + [Sanitizer.sanitizeFor with config: removeElements list ["i", "dl"\]}] expected: FAIL - [Sanitizer.sanitizeFor("div", "Hello") obeys parse context.] + [Sanitizer.sanitizeFor with config: removeElements list ["i", "dl"\]} with uppercase HTML] expected: FAIL - [Sanitizer.sanitizeFor("div", "
test
"; const probe = sanitizer => { - const div = document.createElement("div"); - div.setHTML(probe_string, {sanitizer: sanitizer}); + let template = document.createElement("template"); + template.innerHTML = probe_string; + let fragment = sanitizer.sanitize(template.content); + let div = document.createElement("div"); + div.append(fragment); return probe_string == div.innerHTML; }; const should_stay_the_same = { - allowElements: [ "div", "p" ], - blockElements: [ "test" ], - dropElements: [ "test" ], - allowAttributes: [{ name: "id", elements: "*"}], - dropAttributes: [{ name: "bla", elements: ["blubb"]}], + elements: [ "div", "p" ], + replaceWithChildrenElements: [ "test" ], + removeElements: [ "test" ], + attributes: ["id"], + removeAttributes: ["bla"], }; const should_modify = { - allowElements: [ "div", "span" ], - blockElements: [ "div" ], - dropElements: [ "p" ], - allowAttributes: [{ name: "id", elements: ["p"] }], - dropAttributes: [{ name: "id", elements: ["div"] }], + elements: [ "div", "span" ], + replaceWithChildrenElements: [ "div" ], + removeElements: [ "p" ], + attributes: ["test"], + removeAttributes: ["id"], }; assert_array_equals(Object.keys(should_stay_the_same), Object.keys(should_modify)); diff --git a/testing/web-platform/tests/sanitizer-api/sanitizer-names.https.html b/testing/web-platform/tests/sanitizer-api/sanitizer-names.https.html index df5dd8549d19..cd33bbc76353 100644 --- a/testing/web-platform/tests/sanitizer-api/sanitizer-names.https.html +++ b/testing/web-platform/tests/sanitizer-api/sanitizer-names.https.html @@ -14,13 +14,12 @@ // Element names: const elems_valid = [ "p", "template", "span", "custom-elements", "potato", - // Arguments will be stringified, so anything that stringifies to a valid - // name is also valid. (E.g. null => "null") - null, undefined, 123 + // name is also valid. + 123 ]; const elems_invalid = [ - "", [], ["*"], ["p"] + "", {name: ""}, ]; // Attribute names: @@ -32,17 +31,16 @@ const all_elems = elems_valid.concat(elems_invalid); const all_attrs = attrs_valid.concat(attrs_invalid); - for (const item of ["allowElements", "dropElements", "blockElements"]) { + for (const item of ["elements", "removeElements", "replaceWithChildrenElements"]) { test(t => { const sanitizer = new Sanitizer({[item]: all_elems}); assert_array_same(sanitizer.getConfiguration()[item], elems_valid.map(x => "" + x)); }, `Element names in config item: ${item}`); } - for (const item of ["allowAttributes", "dropAttributes"]) { + for (const item of ["attributes", "removeAttributes"]) { test(t => { - const sanitizer = new Sanitizer( - {[item]: Object.fromEntries(all_attrs.map(x => [x, ["*"]]))}); + const sanitizer = new Sanitizer({[item]: all_attrs}); assert_array_same(Object.keys(sanitizer.getConfiguration()[item]), attrs_valid.map(x => "" + x)); }, `Attribute names in config item: ${item}`); @@ -64,46 +62,50 @@ [ { name: "math", namespace: MATHML_NS }, "" ], ].forEach(([elem, probe, expected], index) => { test(t => { - const sanitizer = new Sanitizer({allowElements: [elem], + const options = { elements: [elem], // TODO(https://github.com/WICG/sanitizer-api/issues/167) - allowUnknownMarkup: true}); + unknownMarkup: true}; const template = document.createElement("template"); - template.setHTML(probe, {sanitizer}); + template.setHTML(probe, {sanitizer: options}); assert_equals(template.innerHTML, expected ?? probe); - }, `Namespaced elements #${index}: allowElements: [${JSON.stringify(elem)}]`); + }, `Namespaced elements #${index}: elements: [${JSON.stringify(elem)}]`); }); // Same for attributes: const XLINK_NS = "http://www.w3.org/1999/xlink"; [ - [ { name: "style", elements: "*" }, "" ], - [ { name: "href", elements: "*" }, "" ], - [ { name: "xlink:href", elements: "*" }, "" ], - [ { name: "href", namespace: XLINK_NS, elements: "*" }, "", "" ], - [ { name: "href", namespace: XLINK_NS, elements: "*" }, "", "" ], - [ { name: "href", elements: "*" }, "", "" ], + [ { name: "style"}, "" ], + [ { name: "href"}, "" ], + [ { name: "xlink:href"}, "" ], + [ { name: "href", namespace: XLINK_NS}, "", "" ], + [ { name: "href", namespace: XLINK_NS}, "", "" ], + [ { name: "href"}, "", "" ], ].forEach(([attr, probe, expected], index) => { test(t => { - const sanitizer = new Sanitizer({allowAttributes: [attr], + const options = {attributes: [attr], // TODO(https://github.com/WICG/sanitizer-api/issues/167) - allowUnknownMarkup: true}); + unknownMarkup: true}; const template = document.createElement("template"); - template.setHTML(probe, {sanitizer}); + template.setHTML(probe, {sanitizer: options}); assert_equals(template.innerHTML, expected ?? probe); - }, `Namespaced attributes #${index}: allowAttributes: [${JSON.stringify(attr)}]`); + }, `Namespaced attributes #${index}: attributes: [${JSON.stringify(attr)}]`); }); // Test for namespaced attribute inside namespace element test(t => { const probe = ``; - const sanitizer = new Sanitizer({ - allowAttributes: [{ name: "href", namespace: XLINK_NS, elements: "*" }], - allowElements: [{ name: "svg", namespace: SVG_NS }, { name: "a", namespace: SVG_NS }], + const options = { + elements: [ + {name: "svg", namespace: SVG_NS}, + {name: "a", namespace: SVG_NS, attributes: [ + { name: "href", namespace: XLINK_NS } + ]} + ], // TODO(https://github.com/WICG/sanitizer-api/issues/167) - allowUnknownMarkup: true}); + unknownMarkup: true}; const template = document.createElement("template"); - template.setHTML(probe, {sanitizer}); + template.setHTML(probe, {sanitizer: options}); assert_equals(template.innerHTML, probe); }, "Namespaced attribute xlink:href inside SVG tree"); @@ -115,14 +117,14 @@ [ "textPath", "