geckon01/PhpSpreadsheet
1
0
Fork 0
mirror of https://github.com/PHPOffice/PhpSpreadsheet.git synced 2026-09-22 08:09:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace ezyang/htmlpurifier with voku/anti-xss (#3724)

Browse Source 
* Replace ezyang/htmlpurifier with voku/anti-xss

* Update XssVulnerabilityTest
This commit is contained in:
dmytromikhieiev1985
2023-09-13 10:29:01 +03:00
committed by GitHub
parent f17e16653d
commit 4e54ed389b
5 changed files with 703 additions and 370 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
+26 -50
View File
@@ -4,84 +4,60 @@ declare(strict_types=1);
namespace PhpOffice\PhpSpreadsheetTests\Writer\Html;
use PhpOffice\PhpSpreadsheet\IOFactory;
use PhpOffice\PhpSpreadsheet\RichText\RichText;
use PhpOffice\PhpSpreadsheet\Shared\File;
use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Html;
use PhpOffice\PhpSpreadsheetTests\Functional;
class XssVulnerabilityTest extends Functional\AbstractFunctional
{
public static function providerAcceptableMarkupRichText(): array
{
return [
'basic text' => ['Hello, I am safely viewing your site', 'Hello, I am safely viewing your site'],
'link' => ["<a href='Visit Google'>Google is here</a>", '<a href="Visit%20Google">Google is here</a>'],
];
}
/**
* @dataProvider providerAcceptableMarkupRichText
*/
public function testMarkupInComment(string $safeTextString, string $adjustedTextString): void
{
$spreadsheet = new Spreadsheet();
$richText = new RichText();
$richText->createText($safeTextString);
$spreadsheet->getActiveSheet()->getCell('A1')->setValue('XSS Test');
$spreadsheet->getActiveSheet()
->getComment('A1')
->setText($richText);
$filename = File::temporaryFilename();
$writer = IOFactory::createWriter($spreadsheet, 'Html');
$writer->save($filename);
$verify = file_get_contents($filename);
unlink($filename);
// Ensure that executable js has been stripped from the comments
self::assertStringContainsString($adjustedTextString, $verify);
}
public static function providerXssRichText(): array
{
return [
'script tag' => ["Hello, I am trying to <script>alert('Hack');</script> your site"],
'javascript tag' => ["<a href='&#x2000;javascript:alert(1)'>CLICK</a>"],
'with unicode' => ['<a href="\\u0001java\\u0003script:alert(1)">CLICK<a>'],
'inline css' => ['<li style="list-style-image: url(javascript:alert(0))">'],
'basic text no problem' => ['Hello, I am safely viewing your site', 'Hello, I am safely viewing your site'],
'link no problem' => ["<a href='Visit Google'>Google is here</a>", "<a href='Visit Google'>Google is here</a>"],
'script tag' => ["Hello, I am trying to <script>alert('Hack');</script> your site", 'Hello, I am trying to your site'],
'javascript tag no hex' => ["<a href='javascript:alert(1)'>CLICK</a>", "<a href='(1)'>CLICK</a>"],
'javascript tag' => ["<a href='&#x2000;javascript:alert(1)'>CLICK</a>", "<a href=' (1)'>CLICK</a>"],
'with unicode' => ['<a href="\\u0001java\\u0003script:alert(1)">CLICK<a>', '<a href="(1)">CLICK<a>'],
'inline css' => ['<li style="list-style-image: url(javascript:alert(0))">', '<li >'],
'char value chevron' => ["\x3cscript src=http://www.example.com/malicious-code.js\x3e\x3c/script\x3e"],
'hexadecimal html' => ['<IMG SRC=&#106&#x61&#x76&#x61&#x73&#109&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>', '<IMG >'],
'iframe' => ['<iframe width="560" onclick="alert(\'xss\')" height="315" src="https://www.youtube.com/embed/whatever?rel=0&controls=0&showinfo=0" frameborder="0" allowfullscreen></iframe>', '&lt;iframe width="560" height="315" src="https://www.youtube.com/embed/whatever?rel=0&controls=0&showinfo=0" frameborder="0" allowfullscreen&gt;&lt;/iframe&gt;'],
];
}
/**
* @dataProvider providerXssRichText
*
* @param string $xssTextString
*/
public function testXssInComment(string $xssTextString): void
public function testXssInComment($xssTextString, ?string $expected = null): void
{
$spreadsheet = new Spreadsheet();
$startCell = '<td class="column0 style0 s">';
$cellText = 'XSS Test';
$endCell = $cellText . '</td>';
if ($expected === null) { // whole comment stripped away
$expected = $startCell . $endCell;
} else {
$expected = $startCell . '<a class="comment-indicator"></a><div class="comment">' . $expected . '</div>' . PHP_EOL . $endCell;
}
$richText = new RichText();
$richText->createText($xssTextString);
$spreadsheet->getActiveSheet()->getCell('A1')->setValue('XSS Test');
$spreadsheet->getActiveSheet()->getCell('A1')->setValue($cellText);
$spreadsheet->getActiveSheet()
->getComment('A1')
->setText($richText);
$filename = File::temporaryFilename();
$writer = new Html($spreadsheet);
$writer = IOFactory::createWriter($spreadsheet, 'Html');
$writer->save($filename);
$verify = file_get_contents($filename);
unlink($filename);
$verify = $writer->generateHtmlAll();
// Ensure that executable js has been stripped from the comments
self::assertStringNotContainsString($xssTextString, $verify);
self::assertStringContainsString($expected, $verify);
$spreadsheet->disconnectWorksheets();
}
}