b
c').toEqual('ab
c');
});
it('should handle large datasets', function() {
// Large is non-trivial to quantify, but handling ~100,000 should be sufficient for most purposes.
var largeNumber = 17; // 2^17 = 131,072
var result = 'b
';
// Ideally we would use repeat, but that isn't supported in IE.
for (var i = 0; i < largeNumber; i++) {
result += result;
}
expectHTML('a' + result + 'c').toEqual('a' + result + 'c');
});
it('should remove style', function() {
expectHTML('ac.').toEqual('ac.');
});
it('should remove style that has newline characters', function() {
expectHTML('ac.').toEqual('ac.');
});
it('should remove double nested script', function() {
expectHTML('ailc.').toEqual('ailc.');
});
it('should remove unknown names', function() {
expectHTML('a
').toEqual('');
});
it('should handle self closed elements', function() {
expectHTML('ac').toEqual('a
c'); }); it('should handle namespace', function() { expectHTML('a
' +
'!@#$%^&*()_+-={}[]:";\'<>?,./`~ ħ
';
expectHTML(everything).toEqual(everything);
});
it('should mangle improper html', function() {
// This text is encoded more than a real HTML parser would, but it should render the same.
expectHTML('< div rel="" alt=abc dir=\'"\' >text< /div>').
toBe('< div rel="" alt=abc dir=\'"\' >text< /div>');
});
it('should mangle improper html2', function() {
// A proper HTML parser would clobber this more in most cases, but it looks reasonable.
expectHTML('< div rel="" / >').
toBe('< div rel="" / >');
});
it('should ignore back slash as escape', function() {
expectHTML('10 < 100
') .toEqual('10 < 100
'); }); it('should accept non-string arguments', function() { expectHTML(null).toBe(''); expectHTML(undefined).toBe(''); expectHTML(42).toBe('42'); expectHTML({}).toBe('[object Object]'); expectHTML([1, 2, 3]).toBe('1,2,3'); expectHTML(true).toBe('true'); expectHTML(false).toBe('false'); }); it('should strip svg elements if not enabled via provider', function() { expectHTML('') .toEqual(''); }); it('should prevent mXSS attacks', function() { expectHTML('CLICKME').toBe('CLICKME'); }); it('should strip html comments', function() { expectHTML('text1text2
') .toEqual('text1text2
'); }); describe('clobbered elements', function() { it('should throw on a form with an input named "parentNode"', function() { inject(function($sanitize) { expect(function() { $sanitize(''); }).toThrowMinErr('$sanitize', 'elclob'); expect(function() { $sanitize(''); }).toThrowMinErr('$sanitize', 'elclob'); }); }); if (!/Edge\/\d{2,}/.test(window.navigator.userAgent)) { // Skip test on Edge due to a browser bug. it('should throw on a form with an input named "nextSibling"', function() { inject(function($sanitize) { expect(function() { $sanitize(''); }).toThrowMinErr('$sanitize', 'elclob'); expect(function() { $sanitize(''); }).toThrowMinErr('$sanitize', 'elclob'); }); }); } }); // See https://github.com/cure53/DOMPurify/blob/a992d3a75031cb8bb032e5ea8399ba972bdf9a65/src/purify.js#L439-L449 it('should not allow JavaScript execution when creating inert document', inject(function($sanitize) { $sanitize(''); expect(window.xxx).toBe(undefined); delete window.xxx; })); // See https://github.com/cure53/DOMPurify/releases/tag/0.6.7 it('should not allow JavaScript hidden in badly formed HTML to get through sanitization (Firefox bug)', inject(function($sanitize) { var doc = $sanitize('