# frozen_string_literal: true require "minitest/autorun" require "rails-html-sanitizer" class ScrubberTest < Minitest::Test protected def scrub_fragment(html) Loofah.scrub_fragment(html, @scrubber).to_s end def assert_scrubbed(html, expected = html) output = scrub_fragment(html) assert_equal expected, output end def to_node(text) Loofah.fragment(text).children.first end def assert_node_skipped(text) assert_scrub_returns(Loofah::Scrubber::CONTINUE, text) end def assert_scrub_stopped(text) assert_scrub_returns(Loofah::Scrubber::STOP, text) end def assert_scrub_returns(return_value, text) node = to_node(text) assert_equal return_value, @scrubber.scrub(node) end end class PermitScrubberTest < ScrubberTest def setup @scrubber = Rails::HTML::PermitScrubber.new end def test_responds_to_scrub assert @scrubber.respond_to?(:scrub) end def test_default_scrub_behavior assert_scrubbed "hello", "hello" end def test_default_scrub_removes_comments assert_scrubbed("
one
three", "
one
three") end def test_default_scrub_removes_processing_instructions input = "
one
three" result = scrub_fragment(input) acceptable_results = [ # jruby cyberneko (nokogiri < 1.14.0) "
one
", # everything else "
one
three", ] assert_includes(acceptable_results, result) end def test_default_attributes_removal_behavior assert_scrubbed '

hello

', "

hello

" end def test_leaves_supplied_tags @scrubber.tags = %w(a) assert_scrubbed "hello" end def test_leaves_only_supplied_tags html = "leave me now" @scrubber.tags = %w(tag) assert_scrubbed html, "leave me now" end def test_prunes_tags @scrubber = Rails::HTML::PermitScrubber.new(prune: true) @scrubber.tags = %w(tag) html = "leave me now" assert_scrubbed html, "leave me " end def test_leaves_comments_when_supplied_as_tag @scrubber.tags = %w(div comment) assert_scrubbed("
one
three", "
one
three") end def test_leaves_only_supplied_tags_nested html = "leave me now" @scrubber.tags = %w(tag) assert_scrubbed html, "leave me now" end def test_leaves_supplied_attributes @scrubber.attributes = %w(cooler) assert_scrubbed '' end def test_leaves_only_supplied_attributes @scrubber.attributes = %w(cooler) assert_scrubbed '', '' end def test_leaves_supplied_tags_and_attributes @scrubber.tags = %w(tag) @scrubber.attributes = %w(cooler) assert_scrubbed '' end def test_leaves_only_supplied_tags_and_attributes @scrubber.tags = %w(tag) @scrubber.attributes = %w(cooler) html = '' assert_scrubbed html, '' end def test_leaves_text assert_scrubbed("some text") end def test_skips_text_nodes assert_node_skipped("some text") end def test_tags_accessor_validation e = assert_raises(ArgumentError) do @scrubber.tags = "tag" end assert_equal "You should pass :tags as an Enumerable", e.message assert_nil @scrubber.tags, "Tags should be nil when validation fails" end def test_attributes_accessor_validation e = assert_raises(ArgumentError) do @scrubber.attributes = "cooler" end assert_equal "You should pass :attributes as an Enumerable", e.message assert_nil @scrubber.attributes, "Attributes should be nil when validation fails" end end class TargetScrubberTest < ScrubberTest def setup @scrubber = Rails::HTML::TargetScrubber.new end def test_targeting_tags_removes_only_them @scrubber.tags = %w(a h1) html = "

" assert_scrubbed html, "" end def test_targeting_tags_removes_only_them_nested @scrubber.tags = %w(a) html = "" assert_scrubbed html, "" end def test_targeting_attributes_removes_only_them @scrubber.attributes = %w(class id) html = '' assert_scrubbed html, '' end def test_targeting_tags_and_attributes_removes_only_them @scrubber.tags = %w(tag) @scrubber.attributes = %w(remove) html = '' assert_scrubbed html, '' end def test_prunes_tags @scrubber = Rails::HTML::TargetScrubber.new(prune: true) @scrubber.tags = %w(span) html = "leave me now" assert_scrubbed html, "leave me " end end class TextOnlyScrubberTest < ScrubberTest def setup @scrubber = Rails::HTML::TextOnlyScrubber.new end def test_removes_all_tags_and_keep_the_content assert_scrubbed "hello", "hello" end def test_skips_text_nodes assert_node_skipped("some text") end end class ReturningStopFromScrubNodeTest < ScrubberTest class ScrubStopper < Rails::HTML::PermitScrubber def scrub_node(node) Loofah::Scrubber::STOP end end def setup @scrubber = ScrubStopper.new end def test_returns_stop_from_scrub_if_scrub_node_does assert_scrub_stopped "" end end