Jakub Zych
f22d08902e
- add a content textarea (size huge) after description, with en and pl phrases - add content to Category.Fillable - export classes.CheckHTML and run it from FormBeforeCreate and FormBeforeUpdate: unsafe category content answers 422 on content, blank content is stored as NULL
35 lines
1.1 KiB
Go
35 lines
1.1 KiB
Go
package classes
|
|
|
|
import "testing"
|
|
|
|
func TestCheckHTML(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
in string
|
|
ok bool
|
|
}{
|
|
{"empty", "", true},
|
|
{"heading and link", `<h2>Cordyceps</h2><p>Plain <a href="https://example.test/a">link</a></p>`, true},
|
|
{"table", `<table><thead><tr><th>A</th></tr></thead><tbody><tr><td>1</td></tr></tbody></table>`, true},
|
|
{"script", `<script>alert(1)</script>`, false},
|
|
{"iframe", `<iframe src="https://example.test/"></iframe>`, false},
|
|
{"object", `<object data=x>`, false},
|
|
{"embed", `<embed src=x>`, false},
|
|
{"event handler", `<img src=x onerror="alert(1)">`, false},
|
|
{"javascript url", `<a href="javascript:alert(1)">`, false},
|
|
{"vbscript url mixed case", `<a href="VBScript:x">`, false},
|
|
{"data url", `<img src="data:image/png;base64,AAAA">`, false},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
err := CheckHTML(tc.in)
|
|
if tc.ok && err != nil {
|
|
t.Fatalf("CheckHTML(%q) = %v, want nil", tc.in, err)
|
|
}
|
|
if !tc.ok && err == nil {
|
|
t.Fatalf("CheckHTML(%q) = nil, want an error", tc.in)
|
|
}
|
|
})
|
|
}
|
|
}
|