|
| 1 | +<?php |
| 2 | + |
| 3 | +use Codeception\Util\Fixtures; |
| 4 | +use Grav\Common\Grav; |
| 5 | +use Grav\Common\Security; |
| 6 | + |
| 7 | +/** |
| 8 | + * Class DetectXssTest |
| 9 | + * |
| 10 | + * Tests for Security::detectXss() — specifically the on_events regex hardening |
| 11 | + * for GHSA-9695-8fr9-hw5q (unquoted event handlers), with parallel coverage |
| 12 | + * for the same bypass pattern called out in GHSA-c2q3-p4jr-c55f and |
| 13 | + * GHSA-w8cg-7jcj-4vv2. |
| 14 | + * |
| 15 | + * Naming convention: test{Method}_{GHSA_ID}_{description} |
| 16 | + */ |
| 17 | +class DetectXssTest extends \PHPUnit\Framework\TestCase |
| 18 | +{ |
| 19 | + /** @var Grav */ |
| 20 | + protected $grav; |
| 21 | + |
| 22 | + protected function setUp(): void |
| 23 | + { |
| 24 | + parent::setUp(); |
| 25 | + $grav = Fixtures::get('grav'); |
| 26 | + $this->grav = $grav(); |
| 27 | + } |
| 28 | + |
| 29 | + // ========================================================================= |
| 30 | + // GHSA-9695-8fr9-hw5q: unquoted on* handlers must be detected |
| 31 | + // ========================================================================= |
| 32 | + |
| 33 | + /** |
| 34 | + * @dataProvider providerGHSA9695_UnquotedOnEvents |
| 35 | + */ |
| 36 | + public function testDetectXss_GHSA9695_FlagsUnquotedEventHandler(string $payload, string $description): void |
| 37 | + { |
| 38 | + $result = Security::detectXss($payload); |
| 39 | + self::assertSame('on_events', $result, "Should flag on_events for: $description"); |
| 40 | + } |
| 41 | + |
| 42 | + public static function providerGHSA9695_UnquotedOnEvents(): array |
| 43 | + { |
| 44 | + return [ |
| 45 | + ['<img src=x onerror=alert(1)>', 'advisory PoC: unquoted onerror, no space before >'], |
| 46 | + ['<img src=x onerror=eval(atob(/Y/.source))>', 'advisory PoC: atob/regex.source obfuscation'], |
| 47 | + ['<svg onload=alert(1)>', 'unquoted onload on svg'], |
| 48 | + ['<body onload=alert(1)>', 'unquoted onload on body'], |
| 49 | + ['<a href=# onclick=alert(1)>x</a>', 'unquoted onclick'], |
| 50 | + // GHSA-c2q3-p4jr-c55f payload — the exact taxonomy escape sequence: |
| 51 | + ['</option></select><img src=x onerror=alert(1)>', 'GHSA-c2q3 select-context break + unquoted onerror'], |
| 52 | + // Obfuscation: whitespace inside the event name (e.g. on error=) |
| 53 | + ['<img src=x on error=alert(1)>', 'whitespace between on and event name'], |
| 54 | + // xmlns is also covered by the same rule — keep regression coverage: |
| 55 | + ['<svg xmlns=http://example.com/ns>', 'unquoted xmlns'], |
| 56 | + ]; |
| 57 | + } |
| 58 | + |
| 59 | + /** |
| 60 | + * @dataProvider providerGHSA9695_QuotedOnEvents |
| 61 | + */ |
| 62 | + public function testDetectXss_GHSA9695_StillFlagsQuotedEventHandlersAfterFix(string $payload, string $description): void |
| 63 | + { |
| 64 | + // Make sure tightening the regex didn't regress the previously-working |
| 65 | + // quoted forms. |
| 66 | + $result = Security::detectXss($payload); |
| 67 | + self::assertSame('on_events', $result, "Should still flag quoted on_events for: $description"); |
| 68 | + } |
| 69 | + |
| 70 | + public static function providerGHSA9695_QuotedOnEvents(): array |
| 71 | + { |
| 72 | + return [ |
| 73 | + ['<img src="x" onerror="alert(1)">', 'double-quoted onerror'], |
| 74 | + ["<img src='x' onerror='alert(1)'>", 'single-quoted onerror'], |
| 75 | + ['<body onload="document.location=\'evil\'">', 'quoted onload'], |
| 76 | + ['<svg onload="fetch(\'/x\')">', 'svg with quoted onload'], |
| 77 | + ]; |
| 78 | + } |
| 79 | + |
| 80 | + // ========================================================================= |
| 81 | + // Negative coverage: legitimate content should not trip on_events |
| 82 | + // ========================================================================= |
| 83 | + |
| 84 | + /** |
| 85 | + * @dataProvider providerSafeContent |
| 86 | + */ |
| 87 | + public function testDetectXss_SafeContentReturnsNullOnEventsRule(string $payload, string $description): void |
| 88 | + { |
| 89 | + // Some safe content may still trip OTHER rules (e.g. the dangerous_tags |
| 90 | + // list), but the on_events rule specifically should not fire. |
| 91 | + $result = Security::detectXss($payload); |
| 92 | + self::assertNotSame('on_events', $result, "on_events must not fire for: $description"); |
| 93 | + } |
| 94 | + |
| 95 | + public static function providerSafeContent(): array |
| 96 | + { |
| 97 | + return [ |
| 98 | + ['<p>Hello world</p>', 'plain paragraph'], |
| 99 | + ['<a href="https://example.com">link</a>', 'link with href'], |
| 100 | + ['<img src="/foo.png" alt="bar">', 'plain img'], |
| 101 | + ['Pricing on demand', 'word starting with "on" outside any tag'], |
| 102 | + ['<button>Click me</button>', 'button tag (ends in "on")'], |
| 103 | + ['<section>content</section>', 'section tag'], |
| 104 | + ]; |
| 105 | + } |
| 106 | + |
| 107 | + // ========================================================================= |
| 108 | + // GHSA-w8cg-7jcj-4vv2: svg/math + GHSA-c2q3 option/select added to defaults |
| 109 | + // ========================================================================= |
| 110 | + |
| 111 | + /** |
| 112 | + * @dataProvider providerGHSAw8cg_NewlyDangerousTags |
| 113 | + */ |
| 114 | + public function testDetectXss_GHSAw8cg_FlagsNewlyDangerousTags(string $payload, string $description): void |
| 115 | + { |
| 116 | + $result = Security::detectXss($payload); |
| 117 | + // Either dangerous_tags (new) or on_events (already covered by #1) is |
| 118 | + // an acceptable trip — both indicate the payload is flagged. |
| 119 | + self::assertNotNull($result, "Should flag: $description"); |
| 120 | + self::assertContains( |
| 121 | + $result, |
| 122 | + ['dangerous_tags', 'on_events'], |
| 123 | + "Expected dangerous_tags or on_events for: $description, got '$result'" |
| 124 | + ); |
| 125 | + } |
| 126 | + |
| 127 | + public static function providerGHSAw8cg_NewlyDangerousTags(): array |
| 128 | + { |
| 129 | + return [ |
| 130 | + ['<svg><script>alert(1)</script></svg>', 'GHSA-w8cg svg with embedded script'], |
| 131 | + ['<svg></svg>', 'svg tag alone'], |
| 132 | + ['<math><mtext>x</mtext></math>', 'math tag (similar XML namespace risk)'], |
| 133 | + ['</option></select>injected', 'GHSA-c2q3 option/select context break'], |
| 134 | + ['<select><option>x</option></select>', 'option/select wrapping'], |
| 135 | + ]; |
| 136 | + } |
| 137 | +} |
0 commit comments