From 9e6313e84f7397889950bef0b870bf91749acca4 Mon Sep 17 00:00:00 2001
From: Angie Byron <webchick@24967.no-reply.drupal.org>
Date: Wed, 7 Jul 2010 17:00:43 +0000
Subject: #715142 by effulgentsia, msmithgu, mr.baileys, Damien Tournoud, sun:
 Fixed Various URLs escaped twice, since check_url() resp.
 filter_xss_bad_protocol() calls check_plain().

---
 modules/simpletest/tests/common.test | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

(limited to 'modules/simpletest/tests/common.test')

diff --git a/modules/simpletest/tests/common.test b/modules/simpletest/tests/common.test
index f374cf04b..01635a5ea 100644
--- a/modules/simpletest/tests/common.test
+++ b/modules/simpletest/tests/common.test
@@ -345,7 +345,7 @@ class CommonXssUnitTest extends DrupalUnitTestCase {
   public static function getInfo() {
     return array(
       'name' => 'String filtering tests',
-      'description' => 'Confirm that check_plain() and filter_xss() work correctly, including invalid multi-byte sequences.',
+      'description' => 'Confirm that check_plain(), filter_xss(), and check_url() work correctly, including invalid multi-byte sequences.',
       'group' => 'System',
     );
   }
@@ -372,6 +372,20 @@ class CommonXssUnitTest extends DrupalUnitTestCase {
      $text = check_plain("<script>");
      $this->assertEqual($text, '&lt;script&gt;', 'check_plain() escapes &lt;script&gt;');
   }
+
+  /**
+   * Check that harmful protocols are stripped.
+   */
+  function testBadProtocolStripping() {
+    // Ensure that check_url() strips out harmful protocols, and encodes for
+    // HTML. Ensure drupal_strip_dangerous_protocols() can be used to return a
+    // plain-text string stripped of harmful protocols.
+    $url = 'javascript:http://www.example.com/?x=1&y=2';
+    $expected_plain = 'http://www.example.com/?x=1&y=2';
+    $expected_html = 'http://www.example.com/?x=1&amp;y=2';
+    $this->assertIdentical(check_url($url), $expected_html, t('check_url() filters a URL and encodes it for HTML.'));
+    $this->assertIdentical(drupal_strip_dangerous_protocols($url), $expected_plain, t('drupal_strip_dangerous_protocols() filters a URL and returns plain text.'));
+  }
 }
 
 class CommonSizeTestCase extends DrupalUnitTestCase {
-- 
cgit v1.2.3