setLanguage(); } #[DataProvider('convertBBCodeProvider')] public function testConvertBbCode(string $expected, string $message): void { self::assertSame($expected, Sanitize::convertBBCode($message)); } /** @return iterable */ public static function convertBBCodeProvider(): iterable { yield '[em]' => ['message', '[em]message[/em]']; yield '[strong]' => ['message', '[strong]message[/strong]']; yield '[code]' => ['message', '[code]message[/code]']; yield '[kbd]' => ['message', '[kbd]message[/kbd]']; yield '[br]' => ['message
message', 'message[br]message']; yield '[sup]' => ['message', '[sup]message[/sup]']; yield '[dochelpicon]' => [ 'a
bDocumentationc', 'a[br]b[dochelpicon]c', ]; yield '[a] link and XSS in href' => [ 'doc' . '[a@javascript:alert('XSS');@target]link', '[a@https://docs.phpmyadmin.net/]doc[/a][a@javascript:alert(\'XSS\');@target]link[/a]', ]; yield '[a] XSS in href' => [ '[a@javascript:alert('XSS');@target]link', '[a@javascript:alert(\'XSS\');@target]link[/a]', ]; yield '[a] XSS escaping after valid link' => [ '[a@./Documentation.html" onmouseover="alert(foo)"]doc', '[a@./Documentation.html" onmouseover="alert(foo)"]doc[/a]', ]; yield '[a] target' => [ 'link', '[a@https://www.phpmyadmin.net/@target]link[/a]', ]; yield '[a] invalid target' => [ '[a@./Documentation.html@INVALID9]doc', '[a@./Documentation.html@INVALID9]doc[/a]', ]; yield '[doc] setup' => [ 'doclink', '[doc@foo]doclink[/doc]', ]; yield '[doc] config' => [ 'doclink', '[doc@cfg_TitleTable]doclink[/doc]', ]; yield '[doc] FAQ' => [ 'doclink', '[doc@faq3-11]doclink[/doc]', ]; yield '[doc] link' => [ 'doclink', '[doc@bookmarks@]doclink[/doc]', ]; } public function testConvertBbCodeSafeParam(): void { self::assertSame( 'a<div onclick="alert('XSS')">b</div>c', Sanitize::convertBBCode('a[em]
b
[/em]c'), ); self::assertSame( 'a
b
c', Sanitize::convertBBCode('a[em]
b
[/em]c', true), ); } #[DataProvider('providerTestSanitizeFileName')] public function testSanitizeFilename(string $expected, string $input, bool $replaceDot): void { self::assertSame($expected, Sanitize::sanitizeFilename($input, $replaceDot)); } /** @return list */ public static function providerTestSanitizeFileName(): array { return [ ['Hello123', 'Hello123', false], ['宮保雞丁', '宮保雞丁', false], ['Україна', 'Україна', false], ['-_-', '-.-', true], ['-.-', '-.-', false], ['___', '"\'"', false], ['_test_', '', false], ['Hello__World_', "Hello\r\nWorld!", false], ['_', "\u{fffd}", false], ['_', '🚀', false], [str_repeat('_', 32), implode('', range("\0", "\x1f")), false], ]; } /** * Test for Sanitize::getJsValue * * @param string $key Key * @param string|bool|int|string[] $value Value * @param string $expected Expected output */ #[DataProvider('variables')] public function testGetJsValue(string $key, string|bool|int|array $value, string $expected): void { self::assertSame($expected, Sanitize::getJsValue($key, $value)); } /** * Provider for testFormat * * @return array */ public static function variables(): array { return [ ['foo', true, "foo = true;\n"], ['foo', false, "foo = false;\n"], ['foo', 100, "foo = 100;\n"], ['foo', 0, "foo = 0;\n"], ['foo', 'text', "foo = \"text\";\n"], ['foo', 'quote"', "foo = \"quote\\\"\";\n"], ['foo', 'apostroph\'', "foo = \"apostroph'\";\n"], ['foo', ['1', '2', '3'], "foo = [\"1\",\"2\",\"3\"];\n"], ['foo', 'bar"baz', "foo = \"bar\\\"baz\";\n"], ]; } /** * Data provider for sanitize links * * @return array */ public static function dataProviderCheckLinks(): array { // Expected // The url // Allow http links // Allow other links return [ [false, 'foo', false, false], [true, './docs/html/', false, false], [false, 'index.php', false, false], [false, './index.php', false, false], [true, './index.php?', false, false], [true, './index.php?route=/server/sql', false, false], [false, 'index.php?route=/server/sql', false, false], [false, 'ftp://ftp.example.com', false, false], [true, 'ftp://ftp.example.com', false, true], [false, 'mailto:admin@domain.tld', false, false], [true, 'mailto:admin@domain.tld', false, true], [false, 'index.php?route=/url&url=https://example.com', false, false], [true, 'index.php?route=/url&url=https%3a%2f%2fexample.com', false, false], [true, 'https://example.com', false, false], [false, 'http://example.com', false, false], [true, 'http://example.com', true, false], ]; } /** * Tests link sanitize */ #[DataProvider('dataProviderCheckLinks')] public function testCheckLink(bool $expected, string $url, bool $http, bool $other): void { self::assertSame( $expected, Sanitize::checkLink($url, $http, $other), ); } }