The Perl Toolchain Summit 2025 Needs You: You can help 🙏 Learn more

KENTARO / Template-Plugin-StripScripts-0.02 / t / 01_stripscripts.t 

            

              
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

              
use strict;
use Template;
use Test::Base;
plan tests => 1 * blocks;
filters { input => 'chomp', output => 'chomp' };
my $tt = Template->new;
run {
    my $block = shift;
    my $input = $block->input;
    $tt->process(\$input, {}, \my $out) or die $tt->error;
    is $out, $block->output, $block->name;
}
__END__
=== HTML without any scripting snipets
--- input
[% USE StripScripts -%]
[% FILTER stripscripts Context             => 'Document',
                       BanList             => ['br'],
                       AllowSrc            => 1,
                       AllowHref           => 1,
                       EscapeFiltered      => 0,
                       ParserOptions       => {
                           strict_names    => 1,
                           strict_comments => 1,
                       },
-%]
<html>
 <head>
  <title>script test page</title>
 </head>
 <body>
  foo
 </body>
</html>
[%- END %]
--- output
<html>
 <head>
  <title>script test page</title>
 </head>
 <body>
  foo
 </body>
</html>
=== HTML which can cause XSS
--- input
[% USE StripScripts -%]
[% FILTER stripscripts Context             => 'Document',
                       BanList             => ['br'],
                       AllowSrc            => 1,
                       AllowHref           => 1,
                       EscapeFiltered      => 0,
                       ParserOptions       => {
                           strict_names    => 1,
                           strict_comments => 1,
                       },
-%]
<html>
 <head>
  <title>script test page</title>
  <script>
   this.is.javascript.and("<this> isn't a tag.  Nor is <b>");
  </script>
  <script>
   <!--
    // script in comments
    foo.foo
   -->
  </script>
 </head>
 <body onload="alert('sctipt in event handler');">
  foo<!--filtered--><!--filtered-->
  <b>baz</b>
  <sctipt type="text/javascript" src="http://example.com/test.js"></script>
  <img src="http://example.com/test.jpg" /><br>
  <a href="http://exapmle.com/test.html">link to an external page</a>
 </body>
</html>
[%- END %]
--- output
<html>
 <head>
  <title>script test page</title>
  <!--filtered--><!--filtered-->
  <!--filtered--><!--filtered-->
 </head>
 <body>
  foo<!--filtered--><!--filtered-->
  <b>baz</b>
  <!--filtered--><!--filtered-->
  <img src="http://example.com/test.jpg" /><!--filtered-->
  <a href="http://exapmle.com/test.html">link to an external page</a>
 </body>
</html>