Jakub Zych
5beb1c5634
The three-regex gate could be bypassed (an attribute without a space, <svg/onload>, entity-encoded or tab-split javascript: URLs, MathML xlink:href, base, meta refresh, forms) and it blanked a whole post or category when ordinary text such as "Data: 12 maja 2024" matched. - sanitizeJournalHtml runs sanitize-html with the Journal plugin's bluemonday policy: UGC elements plus footer, class, schema.org microdata, four validated inline styles, footnote roles, dir=auto, two chat transcript data attributes; http, https, mailto and relative URLs only - gateJournalHtml and isSafeJournalHtml keep their signatures; html is always the sanitized value and is never blanked - post body, category content and both page payloads are sanitized; the blocked notice, its style and string, and the blocked props and content_blocked field are removed - toPostView moves to postView.ts so list pages and cards do not load the sanitizer - tests cover every bypass from the review, the Data:/metadata: text and an imported author footer; the SSR smoke expects the unsafe sample's safe paragraphs
45 lines
1.7 KiB
Plaintext
45 lines
1.7 KiB
Plaintext
# SSR expectations against the acme fixtures (testing/fixtures/acme).
|
|
# Grammar: STATUS PATH [contains=TEXT] [notcontains=TEXT] [type=PREFIX]
|
|
# The consumer enables en (default, no prefix) and pl (/pl prefix), and sets
|
|
# site.url to https://acme.test.
|
|
|
|
# Single post
|
|
200 /blog/hello-acme contains=Hello Acme
|
|
404 /blog/missing-post
|
|
200 /blog/unsafe-sample contains=<p>Before</p><p>After</p> notcontains=alert(
|
|
404 /blog/draft-note
|
|
|
|
# Post index and pagination (9 per page, 13 published posts: 2 pages)
|
|
200 /blog contains=Hello Acme
|
|
200 /blog?page=2
|
|
404 /blog?page=3
|
|
404 /blog?page=abc
|
|
404 /blog?page=0
|
|
200 /pl/blog contains=Najnowsze wpisy
|
|
|
|
# Categories (include_empty=1; content renders above the list)
|
|
200 /blog/category/news contains=Acme news marker
|
|
200 /blog/category/quiet contains=There are no posts in this category yet.
|
|
404 /blog/category/nope
|
|
|
|
# Related posts fall back to the latest posts for a post without a category
|
|
200 /blog/uncategorised-note contains=Hello Acme
|
|
|
|
# Author (slug and login resolve) and tag pages
|
|
200 /blog/author/jane-doe contains=Jane Doe
|
|
200 /blog/author/jdoe contains=<link rel="canonical" href="https://acme.test/blog/author/jane-doe"
|
|
404 /blog/author/nobody
|
|
200 /blog/tag/release contains=Hello Acme
|
|
404 /blog/tag/nope
|
|
|
|
# RSS, sitemap, canonical and meta
|
|
200 /rss.xml type=application/rss+xml
|
|
200 /blog contains=href="/rss.xml"
|
|
200 /sitemap.xml contains=/blog/hello-acme
|
|
200 /sitemap.xml contains=/blog/category/quiet
|
|
200 /sitemap.xml notcontains=/blog/draft-note
|
|
200 /blog?page=2 contains=?page=2
|
|
200 /blog?page=2 contains=<link rel="canonical" href="https://acme.test/blog?page=2">
|
|
200 /blog/hello-acme contains=og:title
|
|
200 /blog/hello-acme contains=Acme says hello and introduces its blog.
|