utils.js 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247
  1. /**
  2. * @license Copyright (c) 2003-2020, CKSource - Frederico Knabben. All rights reserved.
  3. * For licensing, see LICENSE.md or https://ckeditor.com/legal/ckeditor-oss-license
  4. */
  5. import ViewDocument from '@ckeditor/ckeditor5-engine/src/view/document';
  6. import ViewDowncastWriter from '@ckeditor/ckeditor5-engine/src/view/downcastwriter';
  7. import AttributeElement from '@ckeditor/ckeditor5-engine/src/view/attributeelement';
  8. import ContainerElement from '@ckeditor/ckeditor5-engine/src/view/containerelement';
  9. import Text from '@ckeditor/ckeditor5-engine/src/view/text';
  10. import Schema from '@ckeditor/ckeditor5-engine/src/model/schema';
  11. import ModelElement from '@ckeditor/ckeditor5-engine/src/model/element';
  12. import { createLinkElement, isLinkElement, ensureSafeUrl, normalizeDecorators, isImageAllowed } from '../src/utils';
  13. describe( 'utils', () => {
  14. describe( 'isLinkElement()', () => {
  15. it( 'should return true for elements created by createLinkElement', () => {
  16. const element = createLinkElement( 'http://ckeditor.com', new ViewDowncastWriter( new ViewDocument() ) );
  17. expect( isLinkElement( element ) ).to.be.true;
  18. } );
  19. it( 'should return false for other AttributeElements', () => {
  20. expect( isLinkElement( new AttributeElement( 'a' ) ) ).to.be.false;
  21. } );
  22. it( 'should return false for ContainerElements', () => {
  23. expect( isLinkElement( new ContainerElement( 'p' ) ) ).to.be.false;
  24. } );
  25. it( 'should return false for text nodes', () => {
  26. expect( isLinkElement( new Text( 'foo' ) ) ).to.be.false;
  27. } );
  28. } );
  29. describe( 'createLinkElement()', () => {
  30. it( 'should create link AttributeElement', () => {
  31. const element = createLinkElement( 'http://cksource.com', new ViewDowncastWriter( new ViewDocument() ) );
  32. expect( isLinkElement( element ) ).to.be.true;
  33. expect( element.priority ).to.equal( 5 );
  34. expect( element.getAttribute( 'href' ) ).to.equal( 'http://cksource.com' );
  35. expect( element.name ).to.equal( 'a' );
  36. } );
  37. } );
  38. describe( 'ensureSafeUrl()', () => {
  39. it( 'returns the same absolute http URL', () => {
  40. const url = 'http://xx.yy/zz#foo';
  41. expect( ensureSafeUrl( url ) ).to.equal( url );
  42. } );
  43. it( 'returns the same absolute https URL', () => {
  44. const url = 'https://xx.yy/zz';
  45. expect( ensureSafeUrl( url ) ).to.equal( url );
  46. } );
  47. it( 'returns the same absolute ftp URL', () => {
  48. const url = 'ftp://xx.yy/zz';
  49. expect( ensureSafeUrl( url ) ).to.equal( url );
  50. } );
  51. it( 'returns the same absolute ftps URL', () => {
  52. const url = 'ftps://xx.yy/zz';
  53. expect( ensureSafeUrl( url ) ).to.equal( url );
  54. } );
  55. it( 'returns the same absolute mailto URL', () => {
  56. const url = 'mailto://foo@bar.com';
  57. expect( ensureSafeUrl( url ) ).to.equal( url );
  58. } );
  59. it( 'returns the same relative URL (starting with a dot)', () => {
  60. const url = './xx/yyy';
  61. expect( ensureSafeUrl( url ) ).to.equal( url );
  62. } );
  63. it( 'returns the same relative URL (starting with two dots)', () => {
  64. const url = '../../xx/yyy';
  65. expect( ensureSafeUrl( url ) ).to.equal( url );
  66. } );
  67. it( 'returns the same relative URL (starting with a slash)', () => {
  68. const url = '/xx/yyy';
  69. expect( ensureSafeUrl( url ) ).to.equal( url );
  70. } );
  71. it( 'returns the same relative URL (starting with a backslash)', () => {
  72. const url = '\\xx\\yyy';
  73. expect( ensureSafeUrl( url ) ).to.equal( url );
  74. } );
  75. it( 'returns the same relative URL (starting with a letter)', () => {
  76. const url = 'xx/yyy';
  77. expect( ensureSafeUrl( url ) ).to.equal( url );
  78. } );
  79. it( 'returns the same URL even if it contains whitespaces', () => {
  80. const url = ' ./xx/ yyy\t';
  81. expect( ensureSafeUrl( url ) ).to.equal( url );
  82. } );
  83. it( 'returns the same URL even if it contains non ASCII characters', () => {
  84. const url = 'https://kłącze.yy/źdźbło';
  85. expect( ensureSafeUrl( url ) ).to.equal( url );
  86. } );
  87. it( 'accepts non string values', () => {
  88. expect( ensureSafeUrl( undefined ) ).to.equal( 'undefined' );
  89. expect( ensureSafeUrl( null ) ).to.equal( 'null' );
  90. } );
  91. it( 'returns safe URL when a malicious URL starts with javascript:', () => {
  92. const url = 'javascript:alert(1)';
  93. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  94. } );
  95. it( 'returns safe URL when a malicious URL starts with an unknown protocol', () => {
  96. const url = 'foo:alert(1)';
  97. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  98. } );
  99. it( 'returns safe URL when a malicious URL contains spaces', () => {
  100. const url = 'java\u0000script:\talert(1)';
  101. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  102. } );
  103. it( 'returns safe URL when a malicious URL contains spaces (2)', () => {
  104. const url = '\u0000 javascript:alert(1)';
  105. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  106. } );
  107. it( 'returns safe URL when a malicious URL contains a safe part', () => {
  108. const url = 'javascript:alert(1)\nhttp://xxx';
  109. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  110. } );
  111. it( 'returns safe URL when a malicious URL contains a safe part (2)', () => {
  112. const url = 'javascript:alert(1);http://xxx';
  113. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  114. } );
  115. } );
  116. describe( 'normalizeDecorators()', () => {
  117. it( 'should transform an entry object to a normalized array', () => {
  118. const callback = () => {};
  119. const entryObject = {
  120. foo: {
  121. mode: 'manual',
  122. label: 'Foo',
  123. attributes: {
  124. foo: 'foo'
  125. }
  126. },
  127. bar: {
  128. mode: 'automatic',
  129. callback,
  130. attributes: {
  131. bar: 'bar'
  132. }
  133. },
  134. baz: {
  135. mode: 'manual',
  136. label: 'Baz label',
  137. attributes: {
  138. target: '_blank',
  139. rel: 'noopener noreferrer'
  140. }
  141. }
  142. };
  143. expect( normalizeDecorators( entryObject ) ).to.deep.equal( [
  144. {
  145. id: 'linkFoo',
  146. mode: 'manual',
  147. label: 'Foo',
  148. attributes: {
  149. foo: 'foo'
  150. }
  151. },
  152. {
  153. id: 'linkBar',
  154. mode: 'automatic',
  155. callback,
  156. attributes: {
  157. bar: 'bar'
  158. }
  159. },
  160. {
  161. id: 'linkBaz',
  162. mode: 'manual',
  163. label: 'Baz label',
  164. attributes: {
  165. target: '_blank',
  166. rel: 'noopener noreferrer'
  167. }
  168. }
  169. ] );
  170. } );
  171. } );
  172. describe( 'isImageAllowed()', () => {
  173. it( 'returns false when passed "null" as element', () => {
  174. expect( isImageAllowed( null, new Schema() ) ).to.equal( false );
  175. } );
  176. it( 'returns false when passed an element that is not the image element', () => {
  177. const element = new ModelElement( 'paragraph' );
  178. expect( isImageAllowed( element, new Schema() ) ).to.equal( false );
  179. } );
  180. it( 'returns false when schema does not allow linking images', () => {
  181. const element = new ModelElement( 'image' );
  182. expect( isImageAllowed( element, new Schema() ) ).to.equal( false );
  183. } );
  184. it( 'returns true when passed an image element and it can be linked', () => {
  185. const element = new ModelElement( 'image' );
  186. const schema = new Schema();
  187. schema.register( 'image', {
  188. allowIn: '$root',
  189. allowAttributes: [ 'linkHref' ]
  190. } );
  191. expect( isImageAllowed( element, schema ) ).to.equal( true );
  192. } );
  193. } );
  194. } );