18ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// Copyright (c) 2013, Mike Samuel 28ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// All rights reserved. 38ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// 48ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// Redistribution and use in source and binary forms, with or without 58ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// modification, are permitted provided that the following conditions 68ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// are met: 78ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// 88ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// Redistributions of source code must retain the above copyright 98ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// notice, this list of conditions and the following disclaimer. 108ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// Redistributions in binary form must reproduce the above copyright 118ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// notice, this list of conditions and the following disclaimer in the 128ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// documentation and/or other materials provided with the distribution. 138ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// Neither the name of the OWASP nor the names of its contributors may 148ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// be used to endorse or promote products derived from this software 158ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// without specific prior written permission. 168ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 178ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 188ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 198ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 208ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 218ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 228ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 238ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 248ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 258ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 268ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 278ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel// POSSIBILITY OF SUCH DAMAGE. 288ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 298ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuelpackage org.owasp.html; 308ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 318ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuelimport java.util.Collections; 328ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 338ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuelimport org.junit.Test; 348ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 358ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuelimport junit.framework.TestCase; 368ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 378ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuelpublic final class CssSchemaTest extends TestCase { 388ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 398ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel @Test 408ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel public static final void testDangerousProperties() { 418ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel for (String key : new String[] { 428ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel // May allow escaping informal visual containment when embedders are 438ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel // not particular about establishing a clipping region. 448ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel "display", 458ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel "float", 468ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel "clear", 478ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel "left", 488ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel "right", 498ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel // May ease trusted path violations by allowing links to impersonate 508ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel // controls in the embedding page. 518ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel "cursor", 528ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel // Allows code execution. 538ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel "-moz-binding", 548ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel }) { 558ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel assertSame(key, CssSchema.DISALLOWED, CssSchema.DEFAULT.forKey(key)); 568ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel } 578ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel } 588ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 598ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel @Test 608ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel public static final void testDangerousTokens() { 618ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel for (String propName : CssSchema.DEFAULT_WHITELIST) { 628ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel CssSchema.Property property = CssSchema.DEFAULT.forKey(propName); 638ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel assertFalse( 648ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel propName, 658ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel property.literals.contains("expression")); 668ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel assertFalse( 678ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel propName, 688ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel property.fnKeys.containsKey("expression(")); 698ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel assertFalse( 708ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel propName, 718ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel property.literals.contains("url")); 728ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel assertFalse( 738ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel propName, 748ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel property.fnKeys.containsKey("url(")); 758ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel } 768ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel } 778ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 788ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel @Test 798ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel public static final void testCustom() { 808ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel CssSchema custom = CssSchema.union( 818ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel CssSchema.DEFAULT, 828ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel CssSchema.withProperties(Collections.singleton("float")) 838ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel ); 848ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel for (String key : CssSchema.DEFINITIONS.keySet()) { 858ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel if (!key.equals("float")) { 868ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel assertSame(key, custom.forKey(key), CssSchema.DEFAULT.forKey(key)); 878ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel } 888ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel } 898ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel CssSchema.Property cssFloat = custom.forKey("float"); 908ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel assertTrue("left in float", cssFloat.literals.contains("left")); 918ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel } 928ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel 938ee01758dfc6f9871c2d4da44b4ce106c6be8020mikesamuel} 94