55 lines
2.0 KiB
PHP
55 lines
2.0 KiB
PHP
<?php
|
||
namespace Xxx\Tests\Unit;
|
||
|
||
use PHPUnit\Framework\Attributes\DataProvider;
|
||
use Xxx\Tests\Support\TestCase;
|
||
|
||
// h() and form_value() in html.lib.php
|
||
class HtmlTest extends TestCase {
|
||
public static function escapes(): array {
|
||
return array(
|
||
'tags' => array('<script>alert(1)</script>', '<script>alert(1)</script>'),
|
||
'double quotes' => array('say "hi"', 'say "hi"'),
|
||
'single quotes' => array("it's", 'it's'),
|
||
'ampersand' => array('fish & chips', 'fish & chips'),
|
||
'plain text' => array('Plain text', 'Plain text'),
|
||
'utf-8' => array('café – “quoted”', 'café – “quoted”'),
|
||
);
|
||
}
|
||
|
||
#[DataProvider('escapes')]
|
||
public function testHEscapesText(string $input, string $expected): void {
|
||
$this->assertSame($expected, h($input));
|
||
}
|
||
|
||
#[DataProvider('escapes')]
|
||
public function testFormValueEscapesText(string $input, string $expected): void {
|
||
$this->assertSame($expected, form_value($input));
|
||
}
|
||
|
||
public function testHKeepsExistingEntities(): void {
|
||
$this->assertSame('Wait… & see', h('Wait… & see'));
|
||
}
|
||
|
||
public function testFormValueEscapesExistingEntitiesSoThatTheyComeBackUnchanged(): void {
|
||
$this->assertSame('Wait&hellip;', form_value('Wait…'));
|
||
$this->assertSame('Wait…', html_entity_decode(form_value('Wait…'), ENT_QUOTES, 'UTF-8'));
|
||
}
|
||
|
||
public function testFormValueStopsATextareaFromEnding(): void {
|
||
$this->assertSame('</textarea><script>', form_value('</textarea><script>'));
|
||
}
|
||
|
||
public function testInvalidUtf8IsReplacedNotDropped(): void {
|
||
$this->assertSame("a\u{FFFD}b", h("a\xC3b"));
|
||
$this->assertSame("a\u{FFFD}b", form_value("a\xC3b"));
|
||
}
|
||
|
||
public function testNonStringsBecomeStrings(): void {
|
||
$this->assertSame('', h(NULL));
|
||
$this->assertSame('42', h(42));
|
||
$this->assertSame('1', form_value(TRUE));
|
||
$this->assertSame('', form_value(NULL));
|
||
}
|
||
}
|