splitting out PasteViewer, DiscussionViewer, AttachmentViewer tests
This commit is contained in:
El RIDO
parent
893d29a046
commit
928215dc5e
11
js/common.js
11
js/common.js
|
|
@ -33,6 +33,7 @@ var a2zString = ['a','b','c','d','e','f','g','h','i','j','k','l','m',
|
||||||
schemas = ['ftp','gopher','http','https','ws','wss'],
|
schemas = ['ftp','gopher','http','https','ws','wss'],
|
||||||
supportedLanguages = ['de', 'es', 'fr', 'it', 'no', 'pl', 'pt', 'oc', 'ru', 'sl', 'zh'],
|
supportedLanguages = ['de', 'es', 'fr', 'it', 'no', 'pl', 'pt', 'oc', 'ru', 'sl', 'zh'],
|
||||||
mimeTypes = ['image/png', 'application/octet-stream'],
|
mimeTypes = ['image/png', 'application/octet-stream'],
|
||||||
|
formats = ['plaintext', 'markdown', 'syntaxhighlighting'],
|
||||||
/**
|
/**
|
||||||
* character to HTML entity lookup table
|
* character to HTML entity lookup table
|
||||||
*
|
*
|
||||||
|
|
@ -140,3 +141,13 @@ exports.jscSupportedLanguages = function() {
|
||||||
return jsc.elements(supportedLanguages);
|
return jsc.elements(supportedLanguages);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// provides a random mime type
|
||||||
|
exports.jscMimeTypes = function() {
|
||||||
|
return jsc.elements(mimeTypes);
|
||||||
|
}
|
||||||
|
|
||||||
|
// provides a random PrivateBin paste formatter
|
||||||
|
exports.jscFormats = function() {
|
||||||
|
return jsc.elements(formats);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
|
||||||
1617
js/test.js
1617
js/test.js
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,92 @@
|
||||||
|
'use strict';
|
||||||
|
var common = require('../common');
|
||||||
|
|
||||||
|
describe('AttachmentViewer', function () {
|
||||||
|
describe('setAttachment, showAttachment, removeAttachment, hideAttachment, hideAttachmentPreview, hasAttachment, getAttachment & moveAttachmentTo', function () {
|
||||||
|
this.timeout(30000);
|
||||||
|
before(function () {
|
||||||
|
cleanup();
|
||||||
|
});
|
||||||
|
|
||||||
|
jsc.property(
|
||||||
|
'displays & hides data as requested',
|
||||||
|
common.jscMimeTypes(),
|
||||||
|
jsc.nearray(common.jscBase64String()),
|
||||||
|
'string',
|
||||||
|
'string',
|
||||||
|
'string',
|
||||||
|
function (mimeType, base64, filename, prefix, postfix) {
|
||||||
|
var clean = jsdom(),
|
||||||
|
data = 'data:' + mimeType + ';base64,' + base64.join(''),
|
||||||
|
isImage = mimeType.substring(0, 6) === 'image/',
|
||||||
|
results = [];
|
||||||
|
prefix = prefix.replace(/%(s|d)/g, '%%');
|
||||||
|
postfix = postfix.replace(/%(s|d)/g, '%%');
|
||||||
|
$('body').html(
|
||||||
|
'<div id="attachment" role="alert" class="hidden alert ' +
|
||||||
|
'alert-info"><span class="glyphicon glyphicon-download-' +
|
||||||
|
'alt" aria-hidden="true"></span> <a class="alert-link">' +
|
||||||
|
'Download attachment</a></div><div id="attachmentPrevie' +
|
||||||
|
'w" class="hidden"></div>'
|
||||||
|
);
|
||||||
|
$.PrivateBin.AttachmentViewer.init();
|
||||||
|
results.push(
|
||||||
|
!$.PrivateBin.AttachmentViewer.hasAttachment() &&
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
$('#attachmentPreview').hasClass('hidden')
|
||||||
|
);
|
||||||
|
if (filename.length) {
|
||||||
|
$.PrivateBin.AttachmentViewer.setAttachment(data, filename);
|
||||||
|
} else {
|
||||||
|
$.PrivateBin.AttachmentViewer.setAttachment(data);
|
||||||
|
}
|
||||||
|
var attachement = $.PrivateBin.AttachmentViewer.getAttachment()
|
||||||
|
results.push(
|
||||||
|
$.PrivateBin.AttachmentViewer.hasAttachment() &&
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
$('#attachmentPreview').hasClass('hidden') &&
|
||||||
|
attachement[0] === data &&
|
||||||
|
attachement[1] === filename
|
||||||
|
);
|
||||||
|
$.PrivateBin.AttachmentViewer.showAttachment();
|
||||||
|
results.push(
|
||||||
|
!$('#attachment').hasClass('hidden') &&
|
||||||
|
(isImage ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
|
||||||
|
);
|
||||||
|
$.PrivateBin.AttachmentViewer.hideAttachment();
|
||||||
|
results.push(
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
(isImage ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
|
||||||
|
);
|
||||||
|
if (isImage) {
|
||||||
|
$.PrivateBin.AttachmentViewer.hideAttachmentPreview();
|
||||||
|
results.push($('#attachmentPreview').hasClass('hidden'));
|
||||||
|
}
|
||||||
|
$.PrivateBin.AttachmentViewer.showAttachment();
|
||||||
|
results.push(
|
||||||
|
!$('#attachment').hasClass('hidden') &&
|
||||||
|
(isImage ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
|
||||||
|
);
|
||||||
|
var element = $('<div></div>');
|
||||||
|
$.PrivateBin.AttachmentViewer.moveAttachmentTo(element, prefix + '%s' + postfix);
|
||||||
|
if (filename.length) {
|
||||||
|
results.push(
|
||||||
|
element.children()[0].href === data &&
|
||||||
|
element.children()[0].getAttribute('download') === filename &&
|
||||||
|
element.children()[0].text === prefix + filename + postfix
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
results.push(element.children()[0].href === data);
|
||||||
|
}
|
||||||
|
$.PrivateBin.AttachmentViewer.removeAttachment();
|
||||||
|
results.push(
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
$('#attachmentPreview').hasClass('hidden')
|
||||||
|
);
|
||||||
|
clean();
|
||||||
|
return results.every(element => element);
|
||||||
|
}
|
||||||
|
);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
|
@ -0,0 +1,92 @@
|
||||||
|
'use strict';
|
||||||
|
var common = require('../common');
|
||||||
|
|
||||||
|
describe('DiscussionViewer', function () {
|
||||||
|
describe('setAttachment, showAttachment, removeAttachment, hideAttachment, hideAttachmentPreview, hasAttachment, getAttachment & moveAttachmentTo', function () {
|
||||||
|
this.timeout(30000);
|
||||||
|
before(function () {
|
||||||
|
cleanup();
|
||||||
|
});
|
||||||
|
|
||||||
|
jsc.property(
|
||||||
|
'displays & hides data as requested',
|
||||||
|
common.jscMimeTypes(),
|
||||||
|
jsc.nearray(common.jscBase64String()),
|
||||||
|
'string',
|
||||||
|
'string',
|
||||||
|
'string',
|
||||||
|
function (mimeType, base64, filename, prefix, postfix) {
|
||||||
|
var clean = jsdom(),
|
||||||
|
data = 'data:' + mimeType + ';base64,' + base64.join(''),
|
||||||
|
isImage = mimeType.substring(0, 6) === 'image/',
|
||||||
|
results = [];
|
||||||
|
prefix = prefix.replace(/%(s|d)/g, '%%');
|
||||||
|
postfix = postfix.replace(/%(s|d)/g, '%%');
|
||||||
|
$('body').html(
|
||||||
|
'<div id="attachment" role="alert" class="hidden alert ' +
|
||||||
|
'alert-info"><span class="glyphicon glyphicon-download-' +
|
||||||
|
'alt" aria-hidden="true"></span> <a class="alert-link">' +
|
||||||
|
'Download attachment</a></div><div id="attachmentPrevie' +
|
||||||
|
'w" class="hidden"></div>'
|
||||||
|
);
|
||||||
|
$.PrivateBin.AttachmentViewer.init();
|
||||||
|
results.push(
|
||||||
|
!$.PrivateBin.AttachmentViewer.hasAttachment() &&
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
$('#attachmentPreview').hasClass('hidden')
|
||||||
|
);
|
||||||
|
if (filename.length) {
|
||||||
|
$.PrivateBin.AttachmentViewer.setAttachment(data, filename);
|
||||||
|
} else {
|
||||||
|
$.PrivateBin.AttachmentViewer.setAttachment(data);
|
||||||
|
}
|
||||||
|
var attachement = $.PrivateBin.AttachmentViewer.getAttachment()
|
||||||
|
results.push(
|
||||||
|
$.PrivateBin.AttachmentViewer.hasAttachment() &&
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
$('#attachmentPreview').hasClass('hidden') &&
|
||||||
|
attachement[0] === data &&
|
||||||
|
attachement[1] === filename
|
||||||
|
);
|
||||||
|
$.PrivateBin.AttachmentViewer.showAttachment();
|
||||||
|
results.push(
|
||||||
|
!$('#attachment').hasClass('hidden') &&
|
||||||
|
(isImage ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
|
||||||
|
);
|
||||||
|
$.PrivateBin.AttachmentViewer.hideAttachment();
|
||||||
|
results.push(
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
(isImage ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
|
||||||
|
);
|
||||||
|
if (isImage) {
|
||||||
|
$.PrivateBin.AttachmentViewer.hideAttachmentPreview();
|
||||||
|
results.push($('#attachmentPreview').hasClass('hidden'));
|
||||||
|
}
|
||||||
|
$.PrivateBin.AttachmentViewer.showAttachment();
|
||||||
|
results.push(
|
||||||
|
!$('#attachment').hasClass('hidden') &&
|
||||||
|
(isImage ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
|
||||||
|
);
|
||||||
|
var element = $('<div></div>');
|
||||||
|
$.PrivateBin.AttachmentViewer.moveAttachmentTo(element, prefix + '%s' + postfix);
|
||||||
|
if (filename.length) {
|
||||||
|
results.push(
|
||||||
|
element.children()[0].href === data &&
|
||||||
|
element.children()[0].getAttribute('download') === filename &&
|
||||||
|
element.children()[0].text === prefix + filename + postfix
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
results.push(element.children()[0].href === data);
|
||||||
|
}
|
||||||
|
$.PrivateBin.AttachmentViewer.removeAttachment();
|
||||||
|
results.push(
|
||||||
|
$('#attachment').hasClass('hidden') &&
|
||||||
|
$('#attachmentPreview').hasClass('hidden')
|
||||||
|
);
|
||||||
|
clean();
|
||||||
|
return results.every(element => element);
|
||||||
|
}
|
||||||
|
);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
|
@ -0,0 +1,116 @@
|
||||||
|
'use strict';
|
||||||
|
var common = require('../common');
|
||||||
|
|
||||||
|
describe('PasteViewer', function () {
|
||||||
|
describe('run, hide, getText, setText, getFormat, setFormat & isPrettyPrinted', function () {
|
||||||
|
this.timeout(30000);
|
||||||
|
before(function () {
|
||||||
|
cleanup();
|
||||||
|
});
|
||||||
|
|
||||||
|
jsc.property(
|
||||||
|
'displays text according to format',
|
||||||
|
common.jscFormats(),
|
||||||
|
'nestring',
|
||||||
|
function (format, text) {
|
||||||
|
var clean = jsdom(),
|
||||||
|
results = [];
|
||||||
|
$('body').html(
|
||||||
|
'<div id="placeholder" class="hidden">+++ no paste text ' +
|
||||||
|
'+++</div><div id="prettymessage" class="hidden"><pre ' +
|
||||||
|
'id="prettyprint" class="prettyprint linenums:1"></pre>' +
|
||||||
|
'</div><div id="plaintext" class="hidden"></div>'
|
||||||
|
);
|
||||||
|
$.PrivateBin.PasteViewer.init();
|
||||||
|
$.PrivateBin.PasteViewer.setFormat(format);
|
||||||
|
$.PrivateBin.PasteViewer.setText('');
|
||||||
|
results.push(
|
||||||
|
$('#placeholder').hasClass('hidden') &&
|
||||||
|
$('#prettymessage').hasClass('hidden') &&
|
||||||
|
$('#plaintext').hasClass('hidden') &&
|
||||||
|
$.PrivateBin.PasteViewer.getFormat() == format &&
|
||||||
|
$.PrivateBin.PasteViewer.getText() == ''
|
||||||
|
);
|
||||||
|
$.PrivateBin.PasteViewer.run();
|
||||||
|
results.push(
|
||||||
|
!$('#placeholder').hasClass('hidden') &&
|
||||||
|
$('#prettymessage').hasClass('hidden') &&
|
||||||
|
$('#plaintext').hasClass('hidden')
|
||||||
|
);
|
||||||
|
$.PrivateBin.PasteViewer.hide();
|
||||||
|
results.push(
|
||||||
|
$('#placeholder').hasClass('hidden') &&
|
||||||
|
$('#prettymessage').hasClass('hidden') &&
|
||||||
|
$('#plaintext').hasClass('hidden')
|
||||||
|
);
|
||||||
|
$.PrivateBin.PasteViewer.setText(text);
|
||||||
|
$.PrivateBin.PasteViewer.run();
|
||||||
|
results.push(
|
||||||
|
$('#placeholder').hasClass('hidden') &&
|
||||||
|
!$.PrivateBin.PasteViewer.isPrettyPrinted() &&
|
||||||
|
$.PrivateBin.PasteViewer.getText() == text
|
||||||
|
);
|
||||||
|
if (format == 'markdown') {
|
||||||
|
results.push(
|
||||||
|
$('#prettymessage').hasClass('hidden') &&
|
||||||
|
!$('#plaintext').hasClass('hidden')
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
results.push(
|
||||||
|
!$('#prettymessage').hasClass('hidden') &&
|
||||||
|
$('#plaintext').hasClass('hidden')
|
||||||
|
);
|
||||||
|
}
|
||||||
|
clean();
|
||||||
|
return results.every(element => element);
|
||||||
|
}
|
||||||
|
);
|
||||||
|
|
||||||
|
jsc.property(
|
||||||
|
'sanitizes XSS',
|
||||||
|
common.jscFormats(),
|
||||||
|
'string',
|
||||||
|
// @see {@link https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet}
|
||||||
|
jsc.elements([
|
||||||
|
'<PLAINTEXT>',
|
||||||
|
'></SCRIPT>">\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>',
|
||||||
|
'\'\';!--"<XSS>=&{()}',
|
||||||
|
'<SCRIPT SRC=http://example.com/xss.js></SCRIPT>',
|
||||||
|
'\'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\\></|\\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>\'-->"></script><script>alert(document.cookie)</script>"><img/id="confirm(1)"/alt="/"src="/"onerror=eval(id)>\'">',
|
||||||
|
'<IMG SRC="javascript:alert(\'XSS\');">',
|
||||||
|
'<IMG SRC=javascript:alert(\'XSS\')>',
|
||||||
|
'<IMG SRC=JaVaScRiPt:alert(\'XSS\')>',
|
||||||
|
'<IMG SRC=javascript:alert("XSS")>',
|
||||||
|
'<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',
|
||||||
|
'<a onmouseover="alert(document.cookie)">xxs link</a>',
|
||||||
|
'<a onmouseover=alert(document.cookie)>xxs link</a>',
|
||||||
|
'<IMG """><SCRIPT>alert("XSS")</SCRIPT>">',
|
||||||
|
'<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>',
|
||||||
|
'<IMG STYLE="xss:expr/*XSS*/ession(alert(\'XSS\'))">',
|
||||||
|
'<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>',
|
||||||
|
'<TABLE BACKGROUND="javascript:alert(\'XSS\')">',
|
||||||
|
'<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')">',
|
||||||
|
'<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="httx://xss.rocks/xss.js"></SCRIPT>'
|
||||||
|
]),
|
||||||
|
'string',
|
||||||
|
function (format, prefix, xss, suffix) {
|
||||||
|
var clean = jsdom(),
|
||||||
|
text = prefix + xss + suffix;
|
||||||
|
$('body').html(
|
||||||
|
'<div id="placeholder" class="hidden">+++ no paste text ' +
|
||||||
|
'+++</div><div id="prettymessage" class="hidden"><pre ' +
|
||||||
|
'id="prettyprint" class="prettyprint linenums:1"></pre>' +
|
||||||
|
'</div><div id="plaintext" class="hidden"></div>'
|
||||||
|
);
|
||||||
|
$.PrivateBin.PasteViewer.init();
|
||||||
|
$.PrivateBin.PasteViewer.setFormat(format);
|
||||||
|
$.PrivateBin.PasteViewer.setText(text);
|
||||||
|
$.PrivateBin.PasteViewer.run();
|
||||||
|
var result = $('body').html().indexOf(xss) === -1;
|
||||||
|
clean();
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
Loading…
Reference in New Issue