sanitizehtml: add a package to sanitize HTML

common/data/text/sanitizehtml/sanitize_test.go

+// Copyright 2017 The LUCI Authors. All rights reserved.
+// Use of this source code is governed under the Apache License, Version 2.0
+// that can be found in the LICENSE file.
+
+package sanitizehtml
+
+import (
+        "bytes"
+        "strings"
+        "testing"
+
+        . "github.com/smartystreets/goconvey/convey"
+)
+
+func TestSanitize(t *testing.T) {
+        t.Parallel()
+
+        cases := []struct{ in, out string }{

[hinoka, 2017/05/02 00:36:16]

Some error test cases would be nice.  eg invalid html

"<div><p>foo</p>"
"<<a href=abc>"
"<p></a alt="blah"></p>"
etc..

[nodir, 2017/05/04 22:11:01]

Done.

+                // Scripts
+                {
+                        `<script src="evil.js"/>`,
+                        ``,
+                },
+
+                // Paragraphs
+                {
+                        `<p style="font-size: 100">hi</p>`,
+                        `<p>hi</p>`,
+                },
+                {
+                        `<P>hi</P>`,
+                        `<p>hi</p>`,
+                },
+                {
+                        `a<br>b`,
+                        `a<br>b`,
+                },
+
+                // Lists
+                {
+                        `<ul foo="bar">
+                                <li x="y">a</li>
+                                <li>a</li>
+                        </ul>`,
+                        `<ul>
+                                <li>a</li>
+                                <li>a</li>
+                        </ul>`,
+                },
+
+                // Links

[Vadim Sh., 2017/05/02 00:16:24]

add a test for a relative URL

[nodir, 2017/05/04 22:11:01]

Done.

+                {
+                        `<a href="https://ci.chromium.org" alt="x">link</a>`,
+                        `<a href="https://ci.chromium.org" alt="x">link</a>`,
+                },
+                {
+                        `<a href="javascript:evil.js">link</a>`,
+                        `<a href="#non-http-or-http-url-stripped">link</a>`,
+                },
+                {
+                        `<a href="about:blank">link</a>`,
+                        `<a href="#non-http-or-http-url-stripped">link</a>`,
+                },
+                {
+                        `<a href="about:blank">link</a>`,

[Vadim Sh., 2017/05/02 00:16:24]

duplication

[nodir, 2017/05/04 22:11:01]

Done.

+                        `<a href="#non-http-or-http-url-stripped">link</a>`,
+                },
+                {
+                        `<a href="%">link</a>`,
+                        `<a href="#invalid-url-stripped">link</a>`,
+                },
+
+                // Tables
+                {
+                        `<table>
+                                <tr colspan="2x">
+                                        <td rowspan=2>a</td>
+                                </tr>
+                                <tr style="">
+                                        <td>b</td>
+                                        <td>c</td>
+                                </tr>
+                        </table>`,
+                        `<table>
+                                <tr colspan="2">
+                                        <td rowspan="2">a</td>
+                                </tr>
+                                <tr>
+                                        <td>b</td>
+                                        <td>c</td>
+                                </tr>
+                        </table>`,
+                },
+
+                // Other
+                {
+                        `<div><strong>hello</strong></div>`,
+                        `<strong>hello</strong>`,
+                },
+                {
+                        `&lt;`,
+                        `&lt;`,
+                },
+                {
+                        `&foobar;`,
+                        `&amp;foobar;`,
+                },
+        }
+
+        for _, c := range cases {

[Vadim Sh., 2017/05/02 00:16:24]

add a test for various malformed HTML, e.g.

<p><a>blah</p></a>

[nodir, 2017/05/04 22:11:01]

Done.

+                c := c
+                Convey(c.in, t, func() {
+                        buf := &bytes.Buffer{}
+                        err := Sanitize(strings.NewReader(c.in), buf)
+                        So(err, ShouldBeNil)
+                        So(buf.String(), ShouldEqual, c.out)
+                })
+        }
+}