function XssTest::providerTestFilterXssNotNormalized
Same name and namespace in other branches
- 9 core/tests/Drupal/Tests/Component/Utility/XssTest.php \Drupal\Tests\Component\Utility\XssTest::providerTestFilterXssNotNormalized()
- 8.9.x core/tests/Drupal/Tests/Component/Utility/XssTest.php \Drupal\Tests\Component\Utility\XssTest::providerTestFilterXssNotNormalized()
- 10 core/tests/Drupal/Tests/Component/Utility/XssTest.php \Drupal\Tests\Component\Utility\XssTest::providerTestFilterXssNotNormalized()
Data provider for testFilterXssNotNormalized().
Return value
array An array of arrays containing the following elements:
- The value to filter.
- The value to expect that's missing after filtering.
- The assertion message.
- (optional) The allowed HTML tags array that should be passed to \Drupal\Component\Utility\Xss::filter().
See also
testFilterXssNotNormalized()
File
-
core/
tests/ Drupal/ Tests/ Component/ Utility/ XssTest.php, line 161
Class
- XssTest
- XSS Filtering tests.
Namespace
Drupal\Tests\Component\UtilityCode
public static function providerTestFilterXssNotNormalized() {
$cases = [
// Tag stripping, different ways to work around removal of HTML tags.
[
'<script>alert(0)</script>',
'script',
'HTML tag stripping -- simple script without special characters.',
],
[
'<script src="http://www.example.com" />',
'script',
'HTML tag stripping -- empty script with source.',
],
[
'<ScRipt sRc=http://www.example.com/>',
'script',
'HTML tag stripping evasion -- varying case.',
],
[
"<script\nsrc\n=\nhttp://www.example.com/\n>",
'script',
'HTML tag stripping evasion -- multiline tag.',
],
[
'<script/a src=http://www.example.com/a.js></script>',
'script',
'HTML tag stripping evasion -- non whitespace character after tag name.',
],
[
'<script/src=http://www.example.com/a.js></script>',
'script',
'HTML tag stripping evasion -- no space between tag and attribute.',
],
// Null between < and tag name works at least with IE6.
[
"<\x00scr\x00ipt>alert(0)</script>",
'ipt',
'HTML tag stripping evasion -- breaking HTML with nulls.',
],
[
"<scrscriptipt src=http://www.example.com/a.js>",
'script',
'HTML tag stripping evasion -- filter just removing "script".',
],
[
'<<script>alert(0);//<</script>',
'script',
'HTML tag stripping evasion -- double opening brackets.',
],
[
'<script src=http://www.example.com/a.js?<b>',
'script',
'HTML tag stripping evasion -- no closing tag.',
],
// DRUPAL-SA-2008-047: This doesn't seem exploitable, but the filter should
// work consistently.
[
'<script>>',
'script',
'HTML tag stripping evasion -- double closing tag.',
],
[
'<script src=//www.example.com/.a>',
'script',
'HTML tag stripping evasion -- no scheme or ending slash.',
],
[
'<script src=http://www.example.com/.a',
'script',
'HTML tag stripping evasion -- no closing bracket.',
],
[
'<script src=http://www.example.com/ <',
'script',
'HTML tag stripping evasion -- opening instead of closing bracket.',
],
[
'<nosuchtag attribute="newScriptInjectionVector">',
'nosuchtag',
'HTML tag stripping evasion -- unknown tag.',
],
[
'<t:set attributeName="innerHTML" to="<script defer>alert(0)</script>">',
't:set',
'HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).',
],
[
'<img """><script>alert(0)</script>',
'script',
'HTML tag stripping evasion -- a malformed image tag.',
[
'img',
],
],
[
'<blockquote><script>alert(0)</script></blockquote>',
'script',
'HTML tag stripping evasion -- script in a blockquote.',
[
'blockquote',
],
],
[
"<!--[if true]><script>alert(0)</script><![endif]-->",
'script',
'HTML tag stripping evasion -- script within a comment.',
],
// Dangerous attributes removal.
[
'<p onmouseover="http://www.example.com/">',
'onmouseover',
'HTML filter attributes removal -- events, no evasion.',
[
'p',
],
],
[
'<li style="list-style-image: url(javascript:alert(0))">',
'style',
'HTML filter attributes removal -- style, no evasion.',
[
'li',
],
],
[
'<img onerror =alert(0)>',
'onerror',
'HTML filter attributes removal evasion -- spaces before equals sign.',
[
'img',
],
],
[
'<img onabort!#$%&()*~+-_.,:;?@[/|\\]^`=alert(0)>',
'onabort',
'HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.',
[
'img',
],
],
[
'<img oNmediAError=alert(0)>',
'onmediaerror',
'HTML filter attributes removal evasion -- varying case.',
[
'img',
],
],
// Works at least with IE6.
[
"<img o\x00nfocus\x00=alert(0)>",
'focus',
'HTML filter attributes removal evasion -- breaking with nulls.',
[
'img',
],
],
// Only whitelisted scheme names allowed in attributes.
[
'<img src="javascript:alert(0)">',
'javascript',
'HTML scheme clearing -- no evasion.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- no quotes.',
[
'img',
],
],
// A bit like CVE-2006-0070.
[
'<img src="javascript:confirm(0)">',
'javascript',
'HTML scheme clearing evasion -- no alert ;)',
[
'img',
],
],
[
'<img src=`javascript:alert(0)`>',
'javascript',
'HTML scheme clearing evasion -- grave accents.',
[
'img',
],
],
[
'<img dynsrc="javascript:alert(0)">',
'javascript',
'HTML scheme clearing -- rare attribute.',
[
'img',
],
],
[
'<table background="javascript:alert(0)">',
'javascript',
'HTML scheme clearing -- another tag.',
[
'table',
],
],
[
'<base href="javascript:alert(0);//">',
'javascript',
'HTML scheme clearing -- one more attribute and tag.',
[
'base',
],
],
[
'<img src="jaVaSCriPt:alert(0)">',
'javascript',
'HTML scheme clearing evasion -- varying case.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- UTF-8 decimal encoding.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- long UTF-8 encoding.',
[
'img',
],
],
[
'<img src=javascript:alert(0)>',
'javascript',
'HTML scheme clearing evasion -- UTF-8 hex encoding.',
[
'img',
],
],
[
"<img src=\"jav\tascript:alert(0)\">",
'script',
'HTML scheme clearing evasion -- an embedded tab.',
[
'img',
],
],
[
'<img src="jav	ascript:alert(0)">',
'script',
'HTML scheme clearing evasion -- an encoded, embedded tab.',
[
'img',
],
],
[
'<img src="jav
ascript:alert(0)">',
'script',
'HTML scheme clearing evasion -- an encoded, embedded newline.',
[
'img',
],
],
// With 
 this test would fail, but the entity gets turned into
// &#xD;, so it's OK.
[
'<img src="jav
ascript:alert(0)">',
'script',
'HTML scheme clearing evasion -- an encoded, embedded carriage return.',
[
'img',
],
],
[
"<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">",
'cript',
'HTML scheme clearing evasion -- broken into many lines.',
[
'img',
],
],
[
"<img src=\"jav\x00a\x00\x00cript:alert(0)\">",
'cript',
'HTML scheme clearing evasion -- embedded nulls.',
[
'img',
],
],
[
'<img src="vbscript:msgbox(0)">',
'vbscript',
'HTML scheme clearing evasion -- another scheme.',
[
'img',
],
],
[
'<img src="nosuchscheme:notice(0)">',
'nosuchscheme',
'HTML scheme clearing evasion -- unknown scheme.',
[
'img',
],
],
// Netscape 4.x javascript entities.
[
'<br size="&{alert(0)}">',
'alert',
'Netscape 4.x javascript entities.',
[
'br',
],
],
// DRUPAL-SA-2008-006: Invalid UTF-8, these only work as reflected XSS with
// Internet Explorer 6.
[
"<p arg=\"\xe0\">\" style=\"background-image: url(javascript:alert(0));\"\xe0<p>",
'style',
'HTML filter -- invalid UTF-8.',
[
'p',
],
],
];
return $cases;
}Buggy or inaccurate documentation? Please file an issue. Need support? Need help programming? Connect with the Drupal community.