Upstream filp/whoops state of the touched files before b6b679db7d
This commit is contained in:
1 parent
8652196c72
commit
aed19f01eb
2 files changed
+1
-48
No files matched your search
@@ -63,49 +63,6 @@ class TemplateHelperTest extends TestCase
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
|
||||
*/
|
||||
public function testEscapeButPreserveUrisIgnoresNonHttpSchemes()
|
||||
{
|
||||
// None of these contain HTML special characters, so escaping leaves them
|
||||
// untouched and the only question is whether they get turned into links.
|
||||
$originals = [
|
||||
// Clicking such a link would run alert(1): the browser decodes %0A to a
|
||||
// newline, which ends the "//x.co/?" JavaScript comment.
|
||||
'javascript://x.co/?%0Aalert(1)',
|
||||
'JAVASCRIPT://x.co/?%0Aalert(1)',
|
||||
'vbscript://x.co/?%0Amsgbox(1)',
|
||||
'data://text.html/?%0Ax',
|
||||
// "_" is between "Z" and "a" in ASCII, so it used to pass as a scheme.
|
||||
'_://x.co/a',
|
||||
'See javascript://x.co/?%0Aalert(document.cookie) for details',
|
||||
];
|
||||
|
||||
foreach ($originals as $original) {
|
||||
$this->assertSame($original, $this->helper->escapeButPreserveUris($original));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
|
||||
*/
|
||||
public function testEscapeButPreserveUrisStillLinksHttpUris()
|
||||
{
|
||||
$originals = [
|
||||
'http://example.com/a',
|
||||
'https://example.com/a',
|
||||
'HTTPS://example.com/a',
|
||||
];
|
||||
|
||||
foreach ($originals as $original) {
|
||||
$this->assertSame(
|
||||
"<a href=\"$original\" target=\"_blank\" rel=\"noreferrer noopener\">$original</a>",
|
||||
$this->helper->escapeButPreserveUris($original)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @covers Whoops\Util\TemplateHelper::breakOnDelimiter
|
||||
*/
|
||||
|
||||
Reference in new issue
Block a user