gotosocial/internal/text/sanitize_test.go

// GoToSocial
// Copyright (C) GoToSocial Authors admin@gotosocial.org
// SPDX-License-Identifier: AGPL-3.0-or-later
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package text_test

import (
	"testing"

	"github.com/stretchr/testify/suite"
	"github.com/superseriousbusiness/gotosocial/internal/text"
)

const (
	sanitizeHTML      = `here's some naughty html: <script>alert(ahhhh)</script> !!!`
	sanitizedHTML     = `here&#39;s some naughty html:  !!!`
	sanitizeOutgoing  = `<p>gotta test some fucking &#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39; marks</p>`
	sanitizedOutgoing = `<p>gotta test some fucking &#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39;&#39; marks</p>`
)

type SanitizeTestSuite struct {
	suite.Suite
}

func (suite *SanitizeTestSuite) TestSanitizeOutgoing() {
	s := text.SanitizeToHTML(sanitizeOutgoing)
	suite.Equal(sanitizedOutgoing, s)
}

func (suite *SanitizeTestSuite) TestSanitizeHTML() {
	s := text.SanitizeToHTML(sanitizeHTML)
	suite.Equal(sanitizedHTML, s)
}

func (suite *SanitizeTestSuite) TestSanitizeCaption1() {
	dodgyCaption := "<script>console.log('haha!')</script>this is just a normal caption ;)"
	sanitized := text.SanitizeToPlaintext(dodgyCaption)
	suite.Equal("this is just a normal caption ;)", sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeCaption2() {
	dodgyCaption := "<em>here's a LOUD caption</em>"
	sanitized := text.SanitizeToPlaintext(dodgyCaption)
	suite.Equal("here's a LOUD caption", sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeCaption3() {
	dodgyCaption := ""
	sanitized := text.SanitizeToPlaintext(dodgyCaption)
	suite.Equal("", sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeCaption4() {
	dodgyCaption := `


here is
a multi line
caption
with some newlines


`
	sanitized := text.SanitizeToPlaintext(dodgyCaption)
	suite.Equal("here is\na multi line\ncaption\nwith some newlines", sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeCaption5() {
	// html-escaped: "<script>console.log('aha!')</script> hello world"
	dodgyCaption := `&lt;script&gt;console.log(&apos;aha!&apos;)&lt;/script&gt; hello world`
	sanitized := text.SanitizeToPlaintext(dodgyCaption)
	suite.Equal("hello world", sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeCaption6() {
	// html-encoded: "<script>console.log('aha!')</script> hello world"
	dodgyCaption := `&lt;&#115;&#99;&#114;&#105;&#112;&#116;&gt;&#99;&#111;&#110;&#115;&#111;&#108;&#101;&period;&#108;&#111;&#103;&lpar;&apos;&#97;&#104;&#97;&excl;&apos;&rpar;&lt;&sol;&#115;&#99;&#114;&#105;&#112;&#116;&gt;&#32;&#104;&#101;&#108;&#108;&#111;&#32;&#119;&#111;&#114;&#108;&#100;`
	sanitized := text.SanitizeToPlaintext(dodgyCaption)
	suite.Equal("hello world", sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeCustomCSS() {
	customCSS := `.toot .username {
	color: var(--link_fg);
	line-height: 2rem;
	margin-top: -0.5rem;
	align-self: start;
	
	white-space: nowrap;
	overflow: hidden;
	text-overflow: ellipsis;
}`
	sanitized := text.SanitizeToPlaintext(customCSS)
	suite.Equal(customCSS, sanitized) // should be the same as it was before
}

func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS1() {
	// try to break out of <style> into <head> and change the document title
	customCSS := "</style><title>pee pee poo poo</title><style>"
	sanitized := text.SanitizeToPlaintext(customCSS)
	suite.Empty(sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS2() {
	// try to break out of <style> into <head> and change the document title
	customCSS := "pee pee poo poo</style><title></title><style>"
	sanitized := text.SanitizeToPlaintext(customCSS)
	suite.Equal("pee pee poo poo", sanitized)
}

func (suite *SanitizeTestSuite) TestSanitizeInlineImg() {
	withInlineImg := "<p>Here's an inline image: <img class=\"fixed-size-img svelte-uci8eb\" aria-hidden=\"false\" alt=\"A black-and-white photo of an Oblique Strategy card. The card reads: 'Define an area as 'safe' and use it as an anchor'.\" title=\"A black-and-white photo of an Oblique Strategy card. The card reads: 'Define an area as 'safe' and use it as an anchor'.\" width=\"0\" height=\"0\" src=\"https://example.org/fileserver/01H7J83147QMCE17C0RS9P10Y9/attachment/small/01H7J8365XXRTCP6CAMGEM49ZE.jpg\" style=\"object-position: 50% 50%;\"></p>"
	sanitized := text.SanitizeToHTML(withInlineImg)
	suite.Equal(`<p>Here&#39;s an inline image: </p>`, sanitized)
}

func TestSanitizeTestSuite(t *testing.T) {
	suite.Run(t, new(SanitizeTestSuite))
}
[chore] Improve copyright header handling (#1608) * [chore] Remove years from all license headers Years or year ranges aren't required in license headers. Many projects have removed them in recent years and it avoids a bit of yearly toil. In many cases our copyright claim was also a bit dodgy since we added the 2021-2023 header to files created after 2021 but you can't claim copyright into the past that way. * [chore] Add license header check This ensures a license header is always added to any new file. This avoids maintainers/reviewers needing to remember to check for and ask for it in case a contribution doesn't include it. * [chore] Add missing license headers * [chore] Further updates to license header * Use the more common // indentend comment format * Remove the hack we had for the linter now that we use the // format * Add SPDX license identifier 2023-03-12 18:00:57 +03:00			`// GoToSocial`
			`// Copyright (C) GoToSocial Authors admin@gotosocial.org`
			`// SPDX-License-Identifier: AGPL-3.0-or-later`
			`//`
			`// This program is free software: you can redistribute it and/or modify`
			`// it under the terms of the GNU Affero General Public License as published by`
			`// the Free Software Foundation, either version 3 of the License, or`
			`// (at your option) any later version.`
			`//`
			`// This program is distributed in the hope that it will be useful,`
			`// but WITHOUT ANY WARRANTY; without even the implied warranty of`
			`// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the`
			`// GNU Affero General Public License for more details.`
			`//`
			`// You should have received a copy of the GNU Affero General Public License`
			`// along with this program. If not, see <http://www.gnu.org/licenses/>.`
Text/status parsing fixes (#141) * aaaaaa * vendor minify * update + test markdown parsing 2021-08-16 20:17:56 +03:00
			`package text_test`

			`import (`
			`"testing"`

			`"github.com/stretchr/testify/suite"`
			`"github.com/superseriousbusiness/gotosocial/internal/text"`
			`)`

			`const (`
[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			sanitizeHTML = `here's some naughty html: <script>alert(ahhhh)</script> !!!`
			sanitizedHTML = `here's some naughty html: !!!`
Text/status parsing fixes (#141) * aaaaaa * vendor minify * update + test markdown parsing 2021-08-16 20:17:56 +03:00			sanitizeOutgoing = `<p>gotta test some fucking ''''''''' marks</p>`
			sanitizedOutgoing = `<p>gotta test some fucking ''''''''' marks</p>`
			`)`

			`type SanitizeTestSuite struct {`
			`suite.Suite`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeOutgoing() {`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`s := text.SanitizeToHTML(sanitizeOutgoing)`
Text/status parsing fixes (#141) * aaaaaa * vendor minify * update + test markdown parsing 2021-08-16 20:17:56 +03:00			`suite.Equal(sanitizedOutgoing, s)`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeHTML() {`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`s := text.SanitizeToHTML(sanitizeHTML)`
Text/status parsing fixes (#141) * aaaaaa * vendor minify * update + test markdown parsing 2021-08-16 20:17:56 +03:00			`suite.Equal(sanitizedHTML, s)`
			`}`

[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`func (suite *SanitizeTestSuite) TestSanitizeCaption1() {`
			`dodgyCaption := "<script>console.log('haha!')</script>this is just a normal caption ;)"`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(dodgyCaption)`
[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`suite.Equal("this is just a normal caption ;)", sanitized)`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeCaption2() {`
			`dodgyCaption := "<em>here's a LOUD caption</em>"`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(dodgyCaption)`
[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`suite.Equal("here's a LOUD caption", sanitized)`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeCaption3() {`
			`dodgyCaption := ""`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(dodgyCaption)`
[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`suite.Equal("", sanitized)`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeCaption4() {`
			dodgyCaption := `


			`here is`
			`a multi line`
			`caption`
			`with some newlines`



			`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(dodgyCaption)`
[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`suite.Equal("here is\na multi line\ncaption\nwith some newlines", sanitized)`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeCaption5() {`
			`// html-escaped: "<script>console.log('aha!')</script> hello world"`
			dodgyCaption := `<script>console.log('aha!')</script> hello world`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(dodgyCaption)`
[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`suite.Equal("hello world", sanitized)`
Text/status parsing fixes (#141) * aaaaaa * vendor minify * update + test markdown parsing 2021-08-16 20:17:56 +03:00			`}`

[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`func (suite *SanitizeTestSuite) TestSanitizeCaption6() {`
			`// html-encoded: "<script>console.log('aha!')</script> hello world"`
			dodgyCaption := `<script>console&period;log('aha&excl;')</script> hello world`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(dodgyCaption)`
[bugfix] Fix HTML escaping in instance title (#607) * move caption sanitization -> sanitize.go * use sanitizeplaintext rather than removehtml * rename sanitizecaption to sanitizeplaintext * avoid removing html twice from statuses * unexport remoteHTML it's no longer used outside the text package so this makes it less confusing * test instance PATCH 2022-05-26 12:37:13 +03:00			`suite.Equal("hello world", sanitized)`
Text/status parsing fixes (#141) * aaaaaa * vendor minify * update + test markdown parsing 2021-08-16 20:17:56 +03:00			`}`

[feature] Allow users to set custom css for their profiles + threads (#808) * add custom css account property + db func to fetch * allow account to get/set custom css * serve custom css for an account * go fmt * use monospace for customcss, add link * add custom css to account cache * fix broken field * add custom css docs to user guide * add `accounts-allow-custom-css` config flag * add allow custom css to /api/v1/instance response * only show/set custom css if allowed to do so * only set/serve custom account css if enabled * update swagger docs * chain promise * make bool a bit clearer * use cache for GetAccountCustomCSSByUsername 2022-09-12 14:14:29 +03:00			`func (suite *SanitizeTestSuite) TestSanitizeCustomCSS() {`
			customCSS := `.toot .username {
			`color: var(--link_fg);`
			`line-height: 2rem;`
			`margin-top: -0.5rem;`
			`align-self: start;`

			`white-space: nowrap;`
			`overflow: hidden;`
			`text-overflow: ellipsis;`
			}`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(customCSS)`
[feature] Allow users to set custom css for their profiles + threads (#808) * add custom css account property + db func to fetch * allow account to get/set custom css * serve custom css for an account * go fmt * use monospace for customcss, add link * add custom css to account cache * fix broken field * add custom css docs to user guide * add `accounts-allow-custom-css` config flag * add allow custom css to /api/v1/instance response * only show/set custom css if allowed to do so * only set/serve custom account css if enabled * update swagger docs * chain promise * make bool a bit clearer * use cache for GetAccountCustomCSSByUsername 2022-09-12 14:14:29 +03:00			`suite.Equal(customCSS, sanitized) // should be the same as it was before`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS1() {`
			`// try to break out of <style> into <head> and change the document title`
			`customCSS := "</style><title>pee pee poo poo</title><style>"`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(customCSS)`
[feature] Allow users to set custom css for their profiles + threads (#808) * add custom css account property + db func to fetch * allow account to get/set custom css * serve custom css for an account * go fmt * use monospace for customcss, add link * add custom css to account cache * fix broken field * add custom css docs to user guide * add `accounts-allow-custom-css` config flag * add allow custom css to /api/v1/instance response * only show/set custom css if allowed to do so * only set/serve custom account css if enabled * update swagger docs * chain promise * make bool a bit clearer * use cache for GetAccountCustomCSSByUsername 2022-09-12 14:14:29 +03:00			`suite.Empty(sanitized)`
			`}`

			`func (suite *SanitizeTestSuite) TestSanitizeNaughtyCustomCSS2() {`
			`// try to break out of <style> into <head> and change the document title`
			`customCSS := "pee pee poo poo</style><title></title><style>"`
[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`sanitized := text.SanitizeToPlaintext(customCSS)`
[feature] Allow users to set custom css for their profiles + threads (#808) * add custom css account property + db func to fetch * allow account to get/set custom css * serve custom css for an account * go fmt * use monospace for customcss, add link * add custom css to account cache * fix broken field * add custom css docs to user guide * add `accounts-allow-custom-css` config flag * add allow custom css to /api/v1/instance response * only show/set custom css if allowed to do so * only set/serve custom account css if enabled * update swagger docs * chain promise * make bool a bit clearer * use cache for GetAccountCustomCSSByUsername 2022-09-12 14:14:29 +03:00			`suite.Equal("pee pee poo poo", sanitized)`
			`}`

[bugfix] Use custom bluemonday policy to disallow inline img tags (#2100) 2023-08-11 15:40:11 +03:00			`func (suite *SanitizeTestSuite) TestSanitizeInlineImg() {`
			withInlineImg := "<p>Here's an inline image: <img class=\"fixed-size-img svelte-uci8eb\" aria-hidden=\"false\" alt=\"A black-and-white photo of an Oblique Strategy card. The card reads: 'Define an area as 'safe' and use it as an anchor'.\" title=\"A black-and-white photo of an Oblique Strategy card. The card reads: 'Define an area as 'safe' and use it as an anchor'.\" width=\"0\" height=\"0\" src=\"https://example.org/fileserver/01H7J83147QMCE17C0RS9P10Y9/attachment/small/01H7J8365XXRTCP6CAMGEM49ZE.jpg\" style=\"object-position: 50% 50%;\"></p>"
			`sanitized := text.SanitizeToHTML(withInlineImg)`
			suite.Equal(`<p>Here's an inline image: </p>`, sanitized)
			`}`

Text/status parsing fixes (#141) * aaaaaa * vendor minify * update + test markdown parsing 2021-08-16 20:17:56 +03:00			`func TestSanitizeTestSuite(t *testing.T) {`
			`suite.Run(t, new(SanitizeTestSuite))`
			`}`