tests/include/utils/XssTest.php

   1 <?php
   2 /*********************************************************************************
   3  * SugarCRM Community Edition is a customer relationship management program developed by
   4  * SugarCRM, Inc. Copyright (C) 2004-2012 SugarCRM Inc.
   5  *
   6  * This program is free software; you can redistribute it and/or modify it under
   7  * the terms of the GNU Affero General Public License version 3 as published by the
   8  * Free Software Foundation with the addition of the following permission added
   9  * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
  10  * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
  11  * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
  12  *
  13  * This program is distributed in the hope that it will be useful, but WITHOUT
  14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  15  * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
  16  * details.
  17  *
  18  * You should have received a copy of the GNU Affero General Public License along with
  19  * this program; if not, see http://www.gnu.org/licenses or write to the Free
  20  * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  21  * 02110-1301 USA.
  22  *
  23  * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
  24  * SW2-130, Cupertino, CA 95014, USA. or at email address contact@sugarcrm.com.
  25  *
  26  * The interactive user interfaces in modified source and object code versions
  27  * of this program must display Appropriate Legal Notices, as required under
  28  * Section 5 of the GNU Affero General Public License version 3.
  29  *
  30  * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
  31  * these Appropriate Legal Notices must retain the display of the "Powered by
  32  * SugarCRM" logo. If the display of the logo is not reasonably feasible for
  33  * technical reasons, the Appropriate Legal Notices must display the words
  34  * "Powered by SugarCRM".
  35  ********************************************************************************/
  36
  37
  38 require_once 'include/utils.php';
  39
  40 class XssTest extends Sugar_PHPUnit_Framework_TestCase
  41 {
  42     var $email_xss;
  43
  44     public function setUp()
  45     {
  46         global $sugar_config;
  47         if(isset($sugar_config['email_xss']))
  48         {
  49             $this->email_xss = $sugar_config['email_xss'];
  50             $sugar_config['email_xss'] = '';
  51         }
  52         if(isset($GLOBALS['sugar_config']['html_allow_objects'])) {
  53             $this->allow_objects = $GLOBALS['sugar_config']['html_allow_objects'];
  54         }
  55         $GLOBALS['sugar_config']['html_allow_objects'] = true;
  56         SugarCleaner::$instance = null;
  57     }
  58
  59     public function tearDown()
  60     {
  61         if(!empty($this->email_xss))
  62         {
  63             global $sugar_config;
  64             $sugar_config['email_xss'] = $this->email_xss;
  65         }
  66     }
  67
  68     public function xssData()
  69     {
  70         return array(
  71             // before, after
  72             array("some data", "some data"),
  73             // a href
  74             array("test <a href=\"http://www.digitalbrandexpressions.com\">link</a>", "test <a href=\"http://www.digitalbrandexpressions.com\">link</a>"),
  75             // xss
  76             array("some data<script>alert('xss!')</script>", "some data"),
  77             // script with src
  78             array("some data<script src=\" http://localhost/xss.js\"></script> and more", "some data and more"),
  79             // applet & script
  80             array("some data<applet> and </applet>more <script src=\" http://localhost/xss.js\"></script>data", "some data and more data"),
  81             // onload
  82             array('some data before<img alt="<script>" src="http://www.symbolset.org/images/peace-sign-2.jpg"; onload="alert(35)" width="1" height="1"/>some data after',
  83             'some data before<img alt="&lt;script&gt;" src="http://www.symbolset.org/images/peace-sign-2.jpg" width="1" height="1" />some data after'),
  84            // JS
  85             array('some data before<img src="http://www.symbolset.org/images/peace-sign-2.jpg"; onload="alert(35)" width="1" height="1"/>some data after',
  86             'some data before<img src="http://www.symbolset.org/images/peace-sign-2.jpg" width="1" height="1" alt="peace-sign-2.jpg" />some data after'),
  87
  88             array('some data before<img src="http://www.symbolset.org/images/peace-sign-2.jpg"; width="1" height="1"/>some data after',
  89             'some data before<img src="http://www.symbolset.org/images/peace-sign-2.jpg" width="1" height="1" alt="peace-sign-2.jpg" />some data after'),
  90
  91             array('<div style="font-family:Calibri;">Roger Smith</div>', '<div style="font-family:Calibri;">Roger Smith</div>'),
  92             array('some data before<img onmouseover onload onmouseover=\'alert(8)\' src="http://www.docspopuli.org/images/Symbol.jpg";\'/>some data after',
  93             'some data before<img src="http://www.docspopuli.org/images/Symbol.jpg" alt="Symbol.jpg" />some data after'),
  94             // xmp
  95             array('<xmp>some data</xmp>', '<pre>some data</pre>'),
  96             // youtube video
  97             array('<object width="425" height="350"><param name="movie" value="http://www.youtube.com/watch?v=dQw4w9WgXcQ" /><param name="wmode" value="transparent" /><embed src="http://www.youtube.com/v/AyPzM5WK8ys" type="application/x-shockwave-flash" wmode="transparent" width="425" height="350" /></object>',
  98                 '<object width="425" height="350" data="http://www.youtube.com/watch?v=dQw4w9WgXcQ" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="http://www.youtube.com/watch?v=dQw4w9WgXcQ" /><param name="wmode" value="transparent" /><embed src="http://www.youtube.com/v/AyPzM5WK8ys" type="application/x-shockwave-flash" wmode="transparent" width="425" height="350" allowscriptaccess="never" allownetworking="internal" /></object>'),
  99             // another youtube video
 100             array('<iframe width="420" height="315" src="http://www.youtube.com/embed/dQw4w9WgXcQ" frameborder="0" allowfullscreen>My Frame</iframe>',
 101             '<iframe width="420" height="315" src="http://www.youtube.com/embed/dQw4w9WgXcQ" frameborder="0">My Frame</iframe>'),
 102             // stuff inside iframe
 103             array('<iframe width="420" height="315" src="http://www.youtube.com/embed/dQw4w9WgXcQ" frameborder="0" allowfullscreen>My <script>alert(\'xss!\')</script>Frame</iframe>',
 104             '<iframe width="420" height="315" src="http://www.youtube.com/embed/dQw4w9WgXcQ" frameborder="0">My Frame</iframe>'),
 105             // body/html/head
 106             array("<body><head><title>My Page</title></head><html>My Content</html></body>", "My Content"),
 107             // link
 108             array('<link rel="stylesheet" type="text/css" href="styles/plain.css" />',
 109             '<link rel="stylesheet" type="text/css" href="styles/plain.css" />'
 110             ),
 111             // international
 112             array('в чащах юга жил-был <img src="http://images.com/fikus.jpg" alt="фикус"> - דג סקרן שט בים מאוכזב ולפתע מצא חברה',
 113             'в чащах юга жил-был <img src="http://images.com/fikus.jpg" alt="фикус" /> - דג סקרן שט בים מאוכזב ולפתע מצא חברה')
 114             );
 115     }
 116
 117     protected function clean($str)
 118     {
 119         return SugarCleaner::cleanHtml($str, false);
 120     }
 121     /**
 122      * @dataProvider xssData
 123      */
 124     public function testXssFilter($before, $after)
 125     {
 126         $this->assertEquals($after, $this->clean($before));
 127     }
 128
 129     /**
 130      * @dataProvider xssData
 131      */
 132     public function testXssFilterBean($before, $after)
 133     {
 134         $bean = new EmailTemplate();
 135                 $bean->body_html = to_html($before);
 136         $bean->cleanBean();
 137         $this->assertEquals(to_html($after), $bean->body_html);
 138     }
 139 }