1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
use strict;
use warnings;
use Test::More;
use HTML::Restrict ();
my $hr = HTML::Restrict->new(
rules => {
iframe => [
qw( width height ),
{
src => qr{^http://www\.youtube\.com},
frameborder => qr{^(0|1)$},
}
],
},
);
cmp_ok(
$hr->process(
q{<iframe width="560" height="315" frameborder="0" src="http://www.youtube.com/embed/9gKeRZM2Iyc"></iframe>}
),
'eq',
q{<iframe width="560" height="315" frameborder="0" src="http://www.youtube.com/embed/9gKeRZM2Iyc"></iframe>},
'all constraints pass',
);
cmp_ok(
$hr->process(
q{<iframe width="560" height="315" src="http://www.hostile.com/" frameborder="0"></iframe>}
),
'eq',
q{<iframe width="560" height="315" frameborder="0"></iframe>},
'one constraint fails',
);
cmp_ok(
$hr->process(
q{<iframe width="560" height="315" src="http://www.hostile.com/" frameborder="A"></iframe>}
),
'eq',
q{<iframe width="560" height="315"></iframe>},
'two constraints fail',
);
$hr = HTML::Restrict->new(
rules => {
iframe => [
{ src => qr{^http://www\.youtube\.com} },
{ frameborder => qr{^(0|1)$} },
{ height => qr{^315$} },
{ width => qr{^560$} },
],
},
);
cmp_ok(
$hr->process(
q{<iframe width="560" height="315" frameborder="0" src="http://www.youtube.com/embed/9gKeRZM2Iyc"></iframe>}
),
'eq',
q{<iframe src="http://www.youtube.com/embed/9gKeRZM2Iyc" frameborder="0" height="315" width="560"></iframe>},
'possible to maintain order',
);
cmp_ok(
$hr->process(
q{<iframe src="http://www.youtube.com/" onclick="alert('hi')"></iframe>}
),
'eq',
q{<iframe src="http://www.youtube.com/" onclick="alert('hi')"></iframe>},
'entities are re-encoded when regex match passes',
);
$hr = HTML::Restrict->new(
rules => {
span => [
{
style => sub {
my $value = shift;
my @values;
while ( $value
=~ /(?:\A|;)\s*([a-z-]+)\s*:\s*([^;\n]+?)\s*(?=;|$)/gc
) {
my ( $prop, $prop_value ) = ( $1, $2 );
if ( $prop =~ /\A(?:margin|padding)\z/
&& $prop_value =~ /\A\d+(?:em|px|)\z/ ) {
push @values, "$prop: $prop_value";
}
}
return
unless @values;
return join '; ', @values;
}
},
{
class => sub { return undef }
},
],
},
);
cmp_ok(
$hr->process(
q{<span class="fish" style="margin: 2px; padding: 7px;border: 2px;">content</span>},
),
'eq',
q{<span style="margin: 2px; padding: 7px">content</span>},
'filter attributes by coderef',
);
done_testing;
|
