utils.js 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249
  1. /**
  2. * @license Copyright (c) 2003-2020, CKSource - Frederico Knabben. All rights reserved.
  3. * For licensing, see LICENSE.md or https://ckeditor.com/legal/ckeditor-oss-license
  4. */
  5. import ViewDocument from '@ckeditor/ckeditor5-engine/src/view/document';
  6. import ViewDowncastWriter from '@ckeditor/ckeditor5-engine/src/view/downcastwriter';
  7. import AttributeElement from '@ckeditor/ckeditor5-engine/src/view/attributeelement';
  8. import ContainerElement from '@ckeditor/ckeditor5-engine/src/view/containerelement';
  9. import Text from '@ckeditor/ckeditor5-engine/src/view/text';
  10. import Schema from '@ckeditor/ckeditor5-engine/src/model/schema';
  11. import ModelElement from '@ckeditor/ckeditor5-engine/src/model/element';
  12. import { createLinkElement, isLinkElement, ensureSafeUrl, normalizeDecorators, isImageAllowed } from '../src/utils';
  13. describe( 'utils', () => {
  14. describe( 'isLinkElement()', () => {
  15. it( 'should return true for elements created by createLinkElement', () => {
  16. const writer = new ViewDowncastWriter( new ViewDocument() );
  17. const element = createLinkElement( 'http://ckeditor.com', { writer } );
  18. expect( isLinkElement( element ) ).to.be.true;
  19. } );
  20. it( 'should return false for other AttributeElements', () => {
  21. expect( isLinkElement( new AttributeElement( 'a' ) ) ).to.be.false;
  22. } );
  23. it( 'should return false for ContainerElements', () => {
  24. expect( isLinkElement( new ContainerElement( 'p' ) ) ).to.be.false;
  25. } );
  26. it( 'should return false for text nodes', () => {
  27. expect( isLinkElement( new Text( 'foo' ) ) ).to.be.false;
  28. } );
  29. } );
  30. describe( 'createLinkElement()', () => {
  31. it( 'should create link AttributeElement', () => {
  32. const writer = new ViewDowncastWriter( new ViewDocument() );
  33. const element = createLinkElement( 'http://cksource.com', { writer } );
  34. expect( isLinkElement( element ) ).to.be.true;
  35. expect( element.priority ).to.equal( 5 );
  36. expect( element.getAttribute( 'href' ) ).to.equal( 'http://cksource.com' );
  37. expect( element.name ).to.equal( 'a' );
  38. } );
  39. } );
  40. describe( 'ensureSafeUrl()', () => {
  41. it( 'returns the same absolute http URL', () => {
  42. const url = 'http://xx.yy/zz#foo';
  43. expect( ensureSafeUrl( url ) ).to.equal( url );
  44. } );
  45. it( 'returns the same absolute https URL', () => {
  46. const url = 'https://xx.yy/zz';
  47. expect( ensureSafeUrl( url ) ).to.equal( url );
  48. } );
  49. it( 'returns the same absolute ftp URL', () => {
  50. const url = 'ftp://xx.yy/zz';
  51. expect( ensureSafeUrl( url ) ).to.equal( url );
  52. } );
  53. it( 'returns the same absolute ftps URL', () => {
  54. const url = 'ftps://xx.yy/zz';
  55. expect( ensureSafeUrl( url ) ).to.equal( url );
  56. } );
  57. it( 'returns the same absolute mailto URL', () => {
  58. const url = 'mailto://foo@bar.com';
  59. expect( ensureSafeUrl( url ) ).to.equal( url );
  60. } );
  61. it( 'returns the same relative URL (starting with a dot)', () => {
  62. const url = './xx/yyy';
  63. expect( ensureSafeUrl( url ) ).to.equal( url );
  64. } );
  65. it( 'returns the same relative URL (starting with two dots)', () => {
  66. const url = '../../xx/yyy';
  67. expect( ensureSafeUrl( url ) ).to.equal( url );
  68. } );
  69. it( 'returns the same relative URL (starting with a slash)', () => {
  70. const url = '/xx/yyy';
  71. expect( ensureSafeUrl( url ) ).to.equal( url );
  72. } );
  73. it( 'returns the same relative URL (starting with a backslash)', () => {
  74. const url = '\\xx\\yyy';
  75. expect( ensureSafeUrl( url ) ).to.equal( url );
  76. } );
  77. it( 'returns the same relative URL (starting with a letter)', () => {
  78. const url = 'xx/yyy';
  79. expect( ensureSafeUrl( url ) ).to.equal( url );
  80. } );
  81. it( 'returns the same URL even if it contains whitespaces', () => {
  82. const url = ' ./xx/ yyy\t';
  83. expect( ensureSafeUrl( url ) ).to.equal( url );
  84. } );
  85. it( 'returns the same URL even if it contains non ASCII characters', () => {
  86. const url = 'https://kłącze.yy/źdźbło';
  87. expect( ensureSafeUrl( url ) ).to.equal( url );
  88. } );
  89. it( 'accepts non string values', () => {
  90. expect( ensureSafeUrl( undefined ) ).to.equal( 'undefined' );
  91. expect( ensureSafeUrl( null ) ).to.equal( 'null' );
  92. } );
  93. it( 'returns safe URL when a malicious URL starts with javascript:', () => {
  94. const url = 'javascript:alert(1)';
  95. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  96. } );
  97. it( 'returns safe URL when a malicious URL starts with an unknown protocol', () => {
  98. const url = 'foo:alert(1)';
  99. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  100. } );
  101. it( 'returns safe URL when a malicious URL contains spaces', () => {
  102. const url = 'java\u0000script:\talert(1)';
  103. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  104. } );
  105. it( 'returns safe URL when a malicious URL contains spaces (2)', () => {
  106. const url = '\u0000 javascript:alert(1)';
  107. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  108. } );
  109. it( 'returns safe URL when a malicious URL contains a safe part', () => {
  110. const url = 'javascript:alert(1)\nhttp://xxx';
  111. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  112. } );
  113. it( 'returns safe URL when a malicious URL contains a safe part (2)', () => {
  114. const url = 'javascript:alert(1);http://xxx';
  115. expect( ensureSafeUrl( url ) ).to.equal( '#' );
  116. } );
  117. } );
  118. describe( 'normalizeDecorators()', () => {
  119. it( 'should transform an entry object to a normalized array', () => {
  120. const callback = () => {};
  121. const entryObject = {
  122. foo: {
  123. mode: 'manual',
  124. label: 'Foo',
  125. attributes: {
  126. foo: 'foo'
  127. }
  128. },
  129. bar: {
  130. mode: 'automatic',
  131. callback,
  132. attributes: {
  133. bar: 'bar'
  134. }
  135. },
  136. baz: {
  137. mode: 'manual',
  138. label: 'Baz label',
  139. attributes: {
  140. target: '_blank',
  141. rel: 'noopener noreferrer'
  142. }
  143. }
  144. };
  145. expect( normalizeDecorators( entryObject ) ).to.deep.equal( [
  146. {
  147. id: 'linkFoo',
  148. mode: 'manual',
  149. label: 'Foo',
  150. attributes: {
  151. foo: 'foo'
  152. }
  153. },
  154. {
  155. id: 'linkBar',
  156. mode: 'automatic',
  157. callback,
  158. attributes: {
  159. bar: 'bar'
  160. }
  161. },
  162. {
  163. id: 'linkBaz',
  164. mode: 'manual',
  165. label: 'Baz label',
  166. attributes: {
  167. target: '_blank',
  168. rel: 'noopener noreferrer'
  169. }
  170. }
  171. ] );
  172. } );
  173. } );
  174. describe( 'isImageAllowed()', () => {
  175. it( 'returns false when passed "null" as element', () => {
  176. expect( isImageAllowed( null, new Schema() ) ).to.equal( false );
  177. } );
  178. it( 'returns false when passed an element that is not the image element', () => {
  179. const element = new ModelElement( 'paragraph' );
  180. expect( isImageAllowed( element, new Schema() ) ).to.equal( false );
  181. } );
  182. it( 'returns false when schema does not allow linking images', () => {
  183. const element = new ModelElement( 'image' );
  184. expect( isImageAllowed( element, new Schema() ) ).to.equal( false );
  185. } );
  186. it( 'returns true when passed an image element and it can be linked', () => {
  187. const element = new ModelElement( 'image' );
  188. const schema = new Schema();
  189. schema.register( 'image', {
  190. allowIn: '$root',
  191. allowAttributes: [ 'linkHref' ]
  192. } );
  193. expect( isImageAllowed( element, schema ) ).to.equal( true );
  194. } );
  195. } );
  196. } );