@@ -600,6 +600,56 @@ def test_disallow_the_dangerous_safelist_combination_of_select_and_style
600
600
refute_includes ( sanitized , "style" )
601
601
end
602
602
603
+ %w[ text/plain text/css image/png image/gif image/jpeg ] . each do |mediatype |
604
+ define_method "test_mediatype_#{ mediatype } _allowed" do
605
+ input = %Q(<img src="data:#{ mediatype } ;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
606
+ expected = input
607
+ actual = safe_list_sanitize ( input )
608
+ assert_equal ( expected , actual )
609
+
610
+ input = %Q(<img src="DATA:#{ mediatype } ;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
611
+ expected = input
612
+ actual = safe_list_sanitize ( input )
613
+ assert_equal ( expected , actual )
614
+ end
615
+ end
616
+
617
+ def test_mediatype_text_html_disallowed
618
+ input = %q(<img src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
619
+ expected = %q(<img>)
620
+ actual = safe_list_sanitize ( input )
621
+ assert_equal ( expected , actual )
622
+
623
+ input = %q(<img src="DATA:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
624
+ expected = %q(<img>)
625
+ actual = safe_list_sanitize ( input )
626
+ assert_equal ( expected , actual )
627
+ end
628
+
629
+ def test_mediatype_image_svg_xml_disallowed
630
+ input = %q(<img src="data:image/svg+xml;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
631
+ expected = %q(<img>)
632
+ actual = safe_list_sanitize ( input )
633
+ assert_equal ( expected , actual )
634
+
635
+ input = %q(<img src="DATA:image/svg+xml;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">)
636
+ expected = %q(<img>)
637
+ actual = safe_list_sanitize ( input )
638
+ assert_equal ( expected , actual )
639
+ end
640
+
641
+ def test_mediatype_other_disallowed
642
+ input = %q(<a href="data:foo;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">foo</a>)
643
+ expected = %q(<a>foo</a>)
644
+ actual = safe_list_sanitize ( input )
645
+ assert_equal ( expected , actual )
646
+
647
+ input = %q(<a href="DATA:foo;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">foo</a>)
648
+ expected = %q(<a>foo</a>)
649
+ actual = safe_list_sanitize ( input )
650
+ assert_equal ( expected , actual )
651
+ end
652
+
603
653
def test_scrubbing_svg_attr_values_that_allow_ref
604
654
input = %Q(<div fill="yellow url(http://bad.com/) #fff">hey</div>)
605
655
expected = %Q(<div fill="yellow #fff">hey</div>)
0 commit comments