sanitizehtml: add a package to sanitize HTML

common/data/text/sanitizehtml/sanitize_test.go

+// Copyright 2017 The LUCI Authors. All rights reserved.
+// Use of this source code is governed under the Apache License, Version 2.0
+// that can be found in the LICENSE file.
+
+package sanitizehtml
+
+import (
+        "bytes"
+        "strings"
+        "testing"
+
+        . "github.com/smartystreets/goconvey/convey"
+)
+
+func TestSanitize(t *testing.T) {
+        t.Parallel()
+
+        cases := []struct {
+                in, out string
+                harmful bool
+        }{
+                // Scripts
+                {
+                        `<script src="evil.js"/>`,
+                        ``,
+                        true,
+                },
+
+                // Paragraphs
+                {
+                        `<p style="font-size: 100">hi</p>`,
+                        `<p>hi</p>`,
+                        false,
+                },
+                {
+                        `<P>hi</P>`,
+                        `<p>hi</p>`,
+                        false,
+                },
+                {
+                        `a<br>b`,
+                        `a<br>b`,
+                        false,
+                },
+
+                // Lists
+                {
+                        `<ul foo="bar">
+                                <li x="y">a</li>
+                                <li>a</li>
+                        </ul>`,
+                        `<ul>
+                                <li>a</li>
+                                <li>a</li>
+                        </ul>`,
+                        false,
+                },
+
+                // Links
+                {
+                        `<a href="https://ci.chromium.org" alt="x">link</a>`,
+                        `<a rel="noopener" target="_blank" href="https://ci.chromium.org" alt="x">link</a>`,
+                        false,
+                },
+                {
+                        `<a href="javascript:evil.js">link</a>`,
+                        `<a rel="noopener" target="_blank" href="#non-http-or-https-url-stripped">link</a>`,
+                        true,
+                },
+                {
+                        `<a href="about:blank">link</a>`,
+                        `<a rel="noopener" target="_blank" href="#non-http-or-https-url-stripped">link</a>`,
+                        false,
+                },
+                {
+                        `<a href="%">link</a>`,
+                        `<a rel="noopener" target="_blank" href="#invalid-url-stripped">link</a>`,
+                        false,
+                },
+                {
+                        `<a href="/foo">link</a>`,
+                        `<a rel="noopener" target="_blank" href="#non-http-or-https-url-stripped">link</a>`,
+                        false,
+                },
+                {
+                        `<<a href=abc>`,
+                        `&lt;<a rel="noopener" target="_blank" href="#non-http-or-https-url-stripped"></a>`,
+                        false,
+                },
+
+                // Tables
+                {
+                        `<table>
+                                <tr colspan="2x">
+                                        <td rowspan=2>a</td>
+                                </tr>
+                                <tr style="">
+                                        <td>b</td>
+                                        <td>c</td>
+                                </tr>
+                        </table>`,
+                        `<table>
+                                <tr colspan="2">
+                                        <td rowspan="2">a</td>
+                                </tr>
+                                <tr>
+                                        <td>b</td>
+                                        <td>c</td>
+                                </tr>
+                        </table>`,
+                        false,
+                },
+
+                // Other
+                {
+                        `<div><strong>hello</strong></div>`,
+                        `<strong>hello</strong>`,
+                        false,
+                },
+                {
+                        `&lt;`,
+                        `&lt;`,
+                        false,
+                },
+                {
+                        `&foobar;`,
+                        `&amp;foobar;`,
+                        false,
+                },
+                {
+                        `<div><p>foo</p>`,
+                        `<p>foo</p>`,
+                        false,
+                },
+                {
+                        `<p></a alt="blah"></p>`,
+                        `<p></p>`,
+                        false,
+                },
+                {
+                        `<p><a>blah</p></a>`,
+                        `<p><a rel="noopener" target="_blank">blah</a></p>`,
+                        false,
+                },
+        }
+
+        for _, c := range cases {
+                c := c
+                Convey(c.in, t, func() {
+                        buf := &bytes.Buffer{}
+                        harmful, err := Sanitize(strings.NewReader(c.in), buf)
+                        So(err, ShouldBeNil)
+                        So(harmful, ShouldEqual, c.harmful)
+                        So(buf.String(), ShouldEqual, c.out)
+                })
+        }
+}