public void DivBackgroundImageWithUnicodedXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = @"<DIV STYLE=""background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028\0027\0058\0053\0053\0027\0029'\0029"">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<div></div>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
static HtmlSanitizerUtility() { _sanitizerReducedSet = new HtmlSanitizer(); _sanitizerReducedSet.AllowedTags = new List<string>() { "b", "blockquote", "code", "del", "dd", "dl", "dt", "em", "h1", "h2", "h3", "i", "kbd", "li", "ol", "p", "pre", "s", "sup", "sub", "strong", "strike", "ul", "br", "hr", }; _noHtmlSanitizer = new HtmlSanitizer(); _baseSite = VirtualPathUtility.ToAbsolute("~/"); }
public void BRJavascriptIncludeXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<BR SIZE=\"&{alert('XSS')}\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<BR>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageInputXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<input type=\"image\">"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void DivJavascriptEscapingXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<div style=\"\";alert('XSS');//\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<div></div>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageDoubleOpenAngleBracketXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<image src=http://ha.ckers.org/scriptlet.html <"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageSpaceAndMetaCharXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC=\"  javascript:alert('XSS');\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageNullBreaksUpXSSTest2() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageNullBreaksUpXSSTest1() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC=java\0script:alert(\"XSS\")>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageMultilineInjectedXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = @"<IMG SRC = "" j a v a s c r i p t : a l e r t ( ' X S S ' ) "" > "; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>\n"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageEmbeddedCarriageReturnXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC=\"jav
ascript:alert('XSS');\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageHexEncodeXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC=javascript:alert('XSS')>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageLongUTF8UnicodeXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC=javascript:alert('XSS')>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void PWithUrlInStyleXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<p STYLE=\"behavior: url(www.ha.ckers.org);\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert // intentionally keep it failing to get notice when reviewing unit tests so can disucss string expected = "<p></p>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageWithVBScriptXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC='vbscript:msgbox(\"XSS\")'>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void XmlNamespaceXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<HTML xmlns:xss> <?import namespace=\"xss\" implementation=\"http://ha.ckers.org/xss.htc\"> <xss:xss>XSS</xss:xss></HTML>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void XmlWithCDataXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<XML ID=I><X><C><![CDATA[<IMG SRC=\"javas]]><![CDATA[cript:alert('XSS');\">]]></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<SPAN></SPAN>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void EmbedTagXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<EMBED SRC=\"http://ha.ckers.org/xss.swf\" AllowScriptAccess=\"always\"></EMBED>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void EmbedSVGXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<EMBED SRC=\"data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==\" type=\"image/svg+xml\" AllowScriptAccess=\"always\"></EMBED>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void AnchorTagStyleExpressionXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "exp/*<A STYLE='no\\xss:noxss(\"*//*\");xss:ex/*XSS*//*/*/pression(alert(\"XSS\"))'>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "exp/*<a></a>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void BaseTagXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<BASE HREF=\"javascript:alert('XSS');//\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void DivExpressionXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<DIV STYLE=\"width: expression(alert('XSS'));\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<div></div>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageStyleExpressionXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG STYLE=\"xss:expr/*XSS*/ession(alert('XSS'))\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<IMG>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void TDXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<TABLE><TD BACKGROUND=\"javascript:alert('XSS')\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<table><tbody><tr><td></td></tr></tbody></table>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void DivBackgroundImageWithExtraCharactersXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<DIV STYLE=\"background-image: url(javascript:alert('XSS'))\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<div></div>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void FrameXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<FRAMESET><FRAME SRC=\"javascript:alert('XSS');\"></FRAMESET>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = ""; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageWithLivescriptXSSTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC=\"Livescript:[code]\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<img>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public static string Sanitize(string unsafeHTML) { var sanitizer = new Html.HtmlSanitizer(); // sanitizer.AllowedTags = new[] { "a", "p", "br", "img" }; var sanitized = sanitizer.Sanitize(unsafeHTML, HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority)); return sanitized; }
public static string Sanitize(string unsafeHTML) { var sanitizer = new Html.HtmlSanitizer(); // sanitizer.AllowedTags = new[] { "a", "p", "br", "img" }; var sanitized = sanitizer.Sanitize(unsafeHTML, HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority)); return(sanitized); }
public void XSSLocatorTest() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<a href=\"'';!--\"<XSS>=&{()}\">"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = @"<a href=""'';!--"">=&{()}"></a>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }
public void ImageXSS2Test() { // Arrange var sanitizer = new HtmlSanitizer(); // Act string htmlFragment = "<IMG SRC=javascript:alert('XSS')>"; string actual = sanitizer.Sanitize(htmlFragment); // Assert string expected = "<IMG>"; Assert.That(actual, Is.EqualTo(expected).IgnoreCase); }