|
@@ -9,10 +9,10 @@ import AttributeElement from '@ckeditor/ckeditor5-engine/src/view/attributeeleme
|
|
|
import ContainerElement from '@ckeditor/ckeditor5-engine/src/view/containerelement';
|
|
import ContainerElement from '@ckeditor/ckeditor5-engine/src/view/containerelement';
|
|
|
import Text from '@ckeditor/ckeditor5-engine/src/view/text';
|
|
import Text from '@ckeditor/ckeditor5-engine/src/view/text';
|
|
|
|
|
|
|
|
-import { createLinkElement, isLinkElement } from '../src/utils';
|
|
|
|
|
|
|
+import { createLinkElement, isLinkElement, ensureSafeUrl } from '../src/utils';
|
|
|
|
|
|
|
|
describe( 'utils', () => {
|
|
describe( 'utils', () => {
|
|
|
- describe( 'isLinkElement', () => {
|
|
|
|
|
|
|
+ describe( 'isLinkElement()', () => {
|
|
|
it( 'should return true for elements created by createLinkElement', () => {
|
|
it( 'should return true for elements created by createLinkElement', () => {
|
|
|
const element = createLinkElement( 'http://ckeditor.com', new ViewWriter( new ViewDocument() ) );
|
|
const element = createLinkElement( 'http://ckeditor.com', new ViewWriter( new ViewDocument() ) );
|
|
|
|
|
|
|
@@ -32,7 +32,7 @@ describe( 'utils', () => {
|
|
|
} );
|
|
} );
|
|
|
} );
|
|
} );
|
|
|
|
|
|
|
|
- describe( 'createLinkElement', () => {
|
|
|
|
|
|
|
+ describe( 'createLinkElement()', () => {
|
|
|
it( 'should create link AttributeElement', () => {
|
|
it( 'should create link AttributeElement', () => {
|
|
|
const element = createLinkElement( 'http://cksource.com', new ViewWriter( new ViewDocument() ) );
|
|
const element = createLinkElement( 'http://cksource.com', new ViewWriter( new ViewDocument() ) );
|
|
|
|
|
|
|
@@ -42,4 +42,119 @@ describe( 'utils', () => {
|
|
|
expect( element.name ).to.equal( 'a' );
|
|
expect( element.name ).to.equal( 'a' );
|
|
|
} );
|
|
} );
|
|
|
} );
|
|
} );
|
|
|
|
|
+
|
|
|
|
|
+ describe( 'ensureSafeUrl()', () => {
|
|
|
|
|
+ it( 'returns the same absolute http URL', () => {
|
|
|
|
|
+ const url = 'http://xx.yy/zz#foo';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same absolute https URL', () => {
|
|
|
|
|
+ const url = 'https://xx.yy/zz';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same absolute ftp URL', () => {
|
|
|
|
|
+ const url = 'ftp://xx.yy/zz';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same absolute ftps URL', () => {
|
|
|
|
|
+ const url = 'ftps://xx.yy/zz';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same absolute mailto URL', () => {
|
|
|
|
|
+ const url = 'mailto://foo@bar.com';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same relative URL (starting with a dot)', () => {
|
|
|
|
|
+ const url = './xx/yyy';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same relative URL (starting with two dots)', () => {
|
|
|
|
|
+ const url = '../../xx/yyy';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same relative URL (starting with a slash)', () => {
|
|
|
|
|
+ const url = '/xx/yyy';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same relative URL (starting with a backslash)', () => {
|
|
|
|
|
+ const url = '\\xx\\yyy';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same relative URL (starting with a letter)', () => {
|
|
|
|
|
+ const url = 'xx/yyy';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same URL even if it contains whitespaces', () => {
|
|
|
|
|
+ const url = ' ./xx/ yyy\t';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns the same URL even if it contains non ASCII characters', () => {
|
|
|
|
|
+ const url = 'https://kłącze.yy/źdźbło';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( url );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'accepts non string values', () => {
|
|
|
|
|
+ expect( ensureSafeUrl( undefined ) ).to.equal( 'undefined' );
|
|
|
|
|
+ expect( ensureSafeUrl( null ) ).to.equal( 'null' );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns safe URL when a malicious URL starts with javascript:', () => {
|
|
|
|
|
+ const url = 'javascript:alert(1)';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( '#' );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns safe URL when a malicious URL starts with an unknown protocol', () => {
|
|
|
|
|
+ const url = 'foo:alert(1)';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( '#' );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns safe URL when a malicious URL contains spaces', () => {
|
|
|
|
|
+ const url = 'java\u0000script:\talert(1)';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( '#' );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns safe URL when a malicious URL contains spaces (2)', () => {
|
|
|
|
|
+ const url = '\u0000 javascript:alert(1)';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( '#' );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns safe URL when a malicious URL contains a safe part', () => {
|
|
|
|
|
+ const url = 'javascript:alert(1)\nhttp://xxx';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( '#' );
|
|
|
|
|
+ } );
|
|
|
|
|
+
|
|
|
|
|
+ it( 'returns safe URL when a malicious URL contains a safe part (2)', () => {
|
|
|
|
|
+ const url = 'javascript:alert(1);http://xxx';
|
|
|
|
|
+
|
|
|
|
|
+ expect( ensureSafeUrl( url ) ).to.equal( '#' );
|
|
|
|
|
+ } );
|
|
|
|
|
+ } );
|
|
|
} );
|
|
} );
|