Club Drupal

<?php

/**

 * @file

 * Tests for filter.module.

 */

/**

 * Tests for text format and filter CRUD operations.

 */

class FilterCRUDTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Filter CRUD operations',

      'description' => 'Test creation, loading, updating, deleting of text formats and filters.',

      'group' => 'Filter',

    );

  }

  function setUp() {

    parent::setUp('filter_test');

  }

  /**

   * Tests CRUD operations for text formats and filters.

   */

  function testTextFormatCRUD() {

    // Add a text format with minimum data only.

    $format = new stdClass();

    $format->format = 'empty_format';

    $format->name = 'Empty format';

    filter_format_save($format);

    $this->verifyTextFormat($format);

    $this->verifyFilters($format);

    // Add another text format specifying all possible properties.

    $format = new stdClass();

    $format->format = 'custom_format';

    $format->name = 'Custom format';

    $format->filters = array(

      'filter_url' => array(

        'status' => 1,

        'settings' => array(

          'filter_url_length' => 30,

        ),

      ),

    );

    filter_format_save($format);

    $this->verifyTextFormat($format);

    $this->verifyFilters($format);

    // Alter some text format properties and save again.

    $format->name = 'Altered format';

    $format->filters['filter_url']['status'] = 0;

    $format->filters['filter_autop']['status'] = 1;

    filter_format_save($format);

    $this->verifyTextFormat($format);

    $this->verifyFilters($format);

    // Add a uncacheable filter and save again.

    $format->filters['filter_test_uncacheable']['status'] = 1;

    filter_format_save($format);

    $this->verifyTextFormat($format);

    $this->verifyFilters($format);

    // Disable the text format.

    filter_format_disable($format);

    $db_format = db_query("SELECT * FROM {filter_format} WHERE format = :format", array(':format' => $format->format))->fetchObject();

    $this->assertFalse($db_format->status, 'Database: Disabled text format is marked as disabled.');

    $formats = filter_formats();

    $this->assertTrue(!isset($formats[$format->format]), 'filter_formats: Disabled text format no longer exists.');

    // Add a new format to check for Xss in format name.

    $format = new stdClass();

    $format->format = 'xss_format';

    $format->name = '<script>alert(123)</script>';

    filter_format_save($format);

    user_role_change_permissions(DRUPAL_ANONYMOUS_RID, array(filter_permission_name($format) => 1));

    $this->drupalGet('filter/tips');

    $this->assertNoRaw($format->name, 'Text format name contains no xss.');

  }

  /**

   * Verifies that a text format is properly stored.

   */

  function verifyTextFormat($format) {

    $t_args = array('%format' => $format->name);

    // Verify text format database record.

    $db_format = db_select('filter_format', 'ff')

      ->fields('ff')

      ->condition('format', $format->format)

      ->execute()

      ->fetchObject();

    $this->assertEqual($db_format->format, $format->format, format_string('Database: Proper format id for text format %format.', $t_args));

    $this->assertEqual($db_format->name, $format->name, format_string('Database: Proper title for text format %format.', $t_args));

    $this->assertEqual($db_format->cache, $format->cache, format_string('Database: Proper cache indicator for text format %format.', $t_args));

    $this->assertEqual($db_format->weight, $format->weight, format_string('Database: Proper weight for text format %format.', $t_args));

    // Verify filter_format_load().

    $filter_format = filter_format_load($format->format);

    $this->assertEqual($filter_format->format, $format->format, format_string('filter_format_load: Proper format id for text format %format.', $t_args));

    $this->assertEqual($filter_format->name, $format->name, format_string('filter_format_load: Proper title for text format %format.', $t_args));

    $this->assertEqual($filter_format->cache, $format->cache, format_string('filter_format_load: Proper cache indicator for text format %format.', $t_args));

    $this->assertEqual($filter_format->weight, $format->weight, format_string('filter_format_load: Proper weight for text format %format.', $t_args));

    // Verify the 'cache' text format property according to enabled filters.

    $filter_info = filter_get_filters();

    $filters = filter_list_format($filter_format->format);

    $cacheable = TRUE;

    foreach ($filters as $name => $filter) {

      // If this filter is not cacheable, update $cacheable accordingly, so we

      // can verify $format->cache after iterating over all filters.

      if ($filter->status && isset($filter_info[$name]['cache']) && !$filter_info[$name]['cache']) {

        $cacheable = FALSE;

        break;

      }

    }

    $this->assertEqual($filter_format->cache, $cacheable, 'Text format contains proper cache property.');

  }

  /**

   * Verifies that filters are properly stored for a text format.

   */

  function verifyFilters($format) {

    // Verify filter database records.

    $filters = db_query("SELECT * FROM {filter} WHERE format = :format", array(':format' => $format->format))->fetchAllAssoc('name');

    $format_filters = $format->filters;

    foreach ($filters as $name => $filter) {

      $t_args = array('%format' => $format->name, '%filter' => $name);

      // Verify that filter status is properly stored.

      $this->assertEqual($filter->status, $format_filters[$name]['status'], format_string('Database: Proper status for %filter in text format %format.', $t_args));

      // Verify that filter settings were properly stored.

      $this->assertEqual(unserialize($filter->settings), isset($format_filters[$name]['settings']) ? $format_filters[$name]['settings'] : array(), format_string('Database: Proper filter settings for %filter in text format %format.', $t_args));

      // Verify that each filter has a module name assigned.

      $this->assertTrue(!empty($filter->module), format_string('Database: Proper module name for %filter in text format %format.', $t_args));

      // Remove the filter from the copy of saved $format to check whether all

      // filters have been processed later.

      unset($format_filters[$name]);

    }

    // Verify that all filters have been processed.

    $this->assertTrue(empty($format_filters), 'Database contains values for all filters in the saved format.');

    // Verify filter_list_format().

    $filters = filter_list_format($format->format);

    $format_filters = $format->filters;

    foreach ($filters as $name => $filter) {

      $t_args = array('%format' => $format->name, '%filter' => $name);

      // Verify that filter status is properly stored.

      $this->assertEqual($filter->status, $format_filters[$name]['status'], format_string('filter_list_format: Proper status for %filter in text format %format.', $t_args));

      // Verify that filter settings were properly stored.

      $this->assertEqual($filter->settings, isset($format_filters[$name]['settings']) ? $format_filters[$name]['settings'] : array(), format_string('filter_list_format: Proper filter settings for %filter in text format %format.', $t_args));

      // Verify that each filter has a module name assigned.

      $this->assertTrue(!empty($filter->module), format_string('filter_list_format: Proper module name for %filter in text format %format.', $t_args));

      // Remove the filter from the copy of saved $format to check whether all

      // filters have been processed later.

      unset($format_filters[$name]);

    }

    // Verify that all filters have been processed.

    $this->assertTrue(empty($format_filters), 'filter_list_format: Loaded filters contain values for all filters in the saved format.');

  }

}

/**

 * Tests the administrative functionality of the Filter module.

 */

class FilterAdminTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Filter administration functionality',

      'description' => 'Thoroughly test the administrative interface of the filter module.',

      'group' => 'Filter',

    );

  }

  function setUp() {

    parent::setUp();

    // Create users.

    $filtered_html_format = filter_format_load('filtered_html');

    $full_html_format = filter_format_load('full_html');

    $this->admin_user = $this->drupalCreateUser(array(

      'administer filters',

      filter_permission_name($filtered_html_format),

      filter_permission_name($full_html_format),

    ));

    $this->web_user = $this->drupalCreateUser(array('create page content', 'edit own page content'));

    $this->drupalLogin($this->admin_user);

  }

  /**

   * Tests the format administration functionality.

   */

  function testFormatAdmin() {

    // Add text format.

    $this->drupalGet('admin/config/content/formats');

    $this->clickLink('Add text format');

    $format_id = drupal_strtolower($this->randomName());

    $name = $this->randomName();

    $edit = array(

      'format' => $format_id,

      'name' => $name,

    );

    $this->drupalPost(NULL, $edit, t('Save configuration'));

    // Verify default weight of the text format.

    $this->drupalGet('admin/config/content/formats');

    $this->assertFieldByName("formats[$format_id][weight]", 0, 'Text format weight was saved.');

    // Change the weight of the text format.

    $edit = array(

      "formats[$format_id][weight]" => 5,

    );

    $this->drupalPost('admin/config/content/formats', $edit, t('Save changes'));

    $this->assertFieldByName("formats[$format_id][weight]", 5, 'Text format weight was saved.');

    // Edit text format.

    $this->drupalGet('admin/config/content/formats');

    $this->assertLinkByHref('admin/config/content/formats/' . $format_id);

    $this->drupalGet('admin/config/content/formats/' . $format_id);

    $this->drupalPost(NULL, array(), t('Save configuration'));

    // Verify that the custom weight of the text format has been retained.

    $this->drupalGet('admin/config/content/formats');

    $this->assertFieldByName("formats[$format_id][weight]", 5, 'Text format weight was retained.');

    // Disable text format.

    $this->assertLinkByHref('admin/config/content/formats/' . $format_id . '/disable');

    $this->drupalGet('admin/config/content/formats/' . $format_id . '/disable');

    $this->drupalPost(NULL, array(), t('Disable'));

    // Verify that disabled text format no longer exists.

    $this->drupalGet('admin/config/content/formats/' . $format_id);

    $this->assertResponse(404, 'Disabled text format no longer exists.');

    // Attempt to create a format of the same machine name as the disabled

    // format but with a different human readable name.

    $edit = array(

      'format' => $format_id,

      'name' => 'New format',

    );

    $this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));

    $this->assertText('The machine-readable name is already in use. It must be unique.');

    // Attempt to create a format of the same human readable name as the

    // disabled format but with a different machine name.

    $edit = array(

      'format' => 'new_format',

      'name' => $name,

    );

    $this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));

    $this->assertRaw(t('Text format names must be unique. A format named %name already exists.', array(

      '%name' => $name,

    )));

  }

  /**

   * Tests filter administration functionality.

   */

  function testFilterAdmin() {

    // URL filter.

    $first_filter = 'filter_url';

    // Line filter.

    $second_filter = 'filter_autop';

    $filtered = 'filtered_html';

    $full = 'full_html';

    $plain = 'plain_text';

    // Check that the fallback format exists and cannot be disabled.

    $this->assertTrue($plain == filter_fallback_format(), 'The fallback format is set to plain text.');

    $this->drupalGet('admin/config/content/formats');

    $this->assertNoRaw('admin/config/content/formats/' . $plain . '/disable', 'Disable link for the fallback format not found.');

    $this->drupalGet('admin/config/content/formats/' . $plain . '/disable');

    $this->assertResponse(403, 'The fallback format cannot be disabled.');

    // Verify access permissions to Full HTML format.

    $this->assertTrue(filter_access(filter_format_load($full), $this->admin_user), 'Admin user may use Full HTML.');

    $this->assertFalse(filter_access(filter_format_load($full), $this->web_user), 'Web user may not use Full HTML.');

    // Add an additional tag.

    $edit = array();

    $edit['filters[filter_html][settings][allowed_html]'] = '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <quote>';

    $this->drupalPost('admin/config/content/formats/' . $filtered, $edit, t('Save configuration'));

    $this->assertFieldByName('filters[filter_html][settings][allowed_html]', $edit['filters[filter_html][settings][allowed_html]'], 'Allowed HTML tag added.');

    $result = db_query('SELECT * FROM {cache_filter}')->fetchObject();

    $this->assertFalse($result, 'Cache cleared.');

    $elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]', array(

      ':first' => 'filters[' . $first_filter . '][weight]',

      ':second' => 'filters[' . $second_filter . '][weight]',

    ));

    $this->assertTrue(!empty($elements), 'Order confirmed in admin interface.');

    // Reorder filters.

    $edit = array();

    $edit['filters[' . $second_filter . '][weight]'] = 1;

    $edit['filters[' . $first_filter . '][weight]'] = 2;

    $this->drupalPost(NULL, $edit, t('Save configuration'));

    $this->assertFieldByName('filters[' . $second_filter . '][weight]', 1, 'Order saved successfully.');

    $this->assertFieldByName('filters[' . $first_filter . '][weight]', 2, 'Order saved successfully.');

    $elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]', array(

      ':first' => 'filters[' . $second_filter . '][weight]',

      ':second' => 'filters[' . $first_filter . '][weight]',

    ));

    $this->assertTrue(!empty($elements), 'Reorder confirmed in admin interface.');

    $result = db_query('SELECT * FROM {filter} WHERE format = :format ORDER BY weight ASC', array(':format' => $filtered));

    $filters = array();

    foreach ($result as $filter) {

      if ($filter->name == $second_filter || $filter->name == $first_filter) {

        $filters[] = $filter;

      }

    }

    $this->assertTrue(($filters[0]->name == $second_filter && $filters[1]->name == $first_filter), 'Order confirmed in database.');

    // Add format.

    $edit = array();

    $edit['format'] = drupal_strtolower($this->randomName());

    $edit['name'] = $this->randomName();

    $edit['roles[' . DRUPAL_AUTHENTICATED_RID . ']'] = 1;

    $edit['filters[' . $second_filter . '][status]'] = TRUE;

    $edit['filters[' . $first_filter . '][status]'] = TRUE;

    $this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));

    $this->assertRaw(t('Added text format %format.', array('%format' => $edit['name'])), 'New filter created.');

    drupal_static_reset('filter_formats');

    $format = filter_format_load($edit['format']);

    $this->assertNotNull($format, 'Format found in database.');

    $this->assertFieldByName('roles[' . DRUPAL_AUTHENTICATED_RID . ']', '', 'Role found.');

    $this->assertFieldByName('filters[' . $second_filter . '][status]', '', 'Line break filter found.');

    $this->assertFieldByName('filters[' . $first_filter . '][status]', '', 'Url filter found.');

    // Disable new filter.

    $this->drupalPost('admin/config/content/formats/' . $format->format . '/disable', array(), t('Disable'));

    $this->assertRaw(t('Disabled text format %format.', array('%format' => $edit['name'])), 'Format successfully disabled.');

    // Allow authenticated users on full HTML.

    $format = filter_format_load($full);

    $edit = array();

    $edit['roles[' . DRUPAL_ANONYMOUS_RID . ']'] = 0;

    $edit['roles[' . DRUPAL_AUTHENTICATED_RID . ']'] = 1;

    $this->drupalPost('admin/config/content/formats/' . $full, $edit, t('Save configuration'));

    $this->assertRaw(t('The text format %format has been updated.', array('%format' => $format->name)), 'Full HTML format successfully updated.');

    // Switch user.

    $this->drupalLogout();

    $this->drupalLogin($this->web_user);

    $this->drupalGet('node/add/page');

    $this->assertRaw('<option value="' . $full . '">Full HTML</option>', 'Full HTML filter accessible.');

    // Use filtered HTML and see if it removes tags that are not allowed.

    $body = '<em>' . $this->randomName() . '</em>';

    $extra_text = 'text';

    $text = $body . '<random>' . $extra_text . '</random>';

    $edit = array();

    $langcode = LANGUAGE_NONE;

    $edit["title"] = $this->randomName();

    $edit["body[$langcode][0][value]"] = $text;

    $edit["body[$langcode][0][format]"] = $filtered;

    $this->drupalPost('node/add/page', $edit, t('Save'));

    $this->assertRaw(t('Basic page %title has been created.', array('%title' => $edit["title"])), 'Filtered node created.');

    $node = $this->drupalGetNodeByTitle($edit["title"]);

    $this->assertTrue($node, 'Node found in database.');

    $this->drupalGet('node/' . $node->nid);

    $this->assertRaw($body . $extra_text, 'Filter removed invalid tag.');

    // Use plain text and see if it escapes all tags, whether allowed or not.

    $edit = array();

    $edit["body[$langcode][0][format]"] = $plain;

    $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));

    $this->drupalGet('node/' . $node->nid);

    $this->assertText(check_plain($text), 'The "Plain text" text format escapes all HTML tags.');

    // Switch user.

    $this->drupalLogout();

    $this->drupalLogin($this->admin_user);

    // Clean up.

    // Allowed tags.

    $edit = array();

    $edit['filters[filter_html][settings][allowed_html]'] = '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>';

    $this->drupalPost('admin/config/content/formats/' . $filtered, $edit, t('Save configuration'));

    $this->assertFieldByName('filters[filter_html][settings][allowed_html]', $edit['filters[filter_html][settings][allowed_html]'], 'Changes reverted.');

    // Full HTML.

    $edit = array();

    $edit['roles[' . DRUPAL_AUTHENTICATED_RID . ']'] = FALSE;

    $this->drupalPost('admin/config/content/formats/' . $full, $edit, t('Save configuration'));

    $this->assertRaw(t('The text format %format has been updated.', array('%format' => $format->name)), 'Full HTML format successfully reverted.');

    $this->assertFieldByName('roles[' . DRUPAL_AUTHENTICATED_RID . ']', $edit['roles[' . DRUPAL_AUTHENTICATED_RID . ']'], 'Changes reverted.');

    // Filter order.

    $edit = array();

    $edit['filters[' . $second_filter . '][weight]'] = 2;

    $edit['filters[' . $first_filter . '][weight]'] = 1;

    $this->drupalPost('admin/config/content/formats/' . $filtered, $edit, t('Save configuration'));

    $this->assertFieldByName('filters[' . $second_filter . '][weight]', $edit['filters[' . $second_filter . '][weight]'], 'Changes reverted.');

    $this->assertFieldByName('filters[' . $first_filter . '][weight]', $edit['filters[' . $first_filter . '][weight]'], 'Changes reverted.');

  }

  /**

   * Tests the URL filter settings form is properly validated.

   */

  function testUrlFilterAdmin() {

    // The form does not save with an invalid filter URL length.

    $edit = array(

      'filters[filter_url][settings][filter_url_length]' => $this->randomName(4),

    );

    $this->drupalPost('admin/config/content/formats/filtered_html', $edit, t('Save configuration'));

    $this->assertNoRaw(t('The text format %format has been updated.', array('%format' => 'Filtered HTML')));

  }

}

/**

 * Tests the filter format access functionality in the Filter module.

 */

class FilterFormatAccessTestCase extends DrupalWebTestCase {

  /**

   * A user with administrative permissions.

   *

   * @var object

   */

  protected $admin_user;

  /**

   * A user with 'administer filters' permission.

   *

   * @var object

   */

  protected $filter_admin_user;

  /**

   * A user with permission to create and edit own content.

   *

   * @var object

   */

  protected $web_user;

  /**

   * An object representing an allowed text format.

   *

   * @var object

   */

  protected $allowed_format;

  /**

   * An object representing a disallowed text format.

   *

   * @var object

   */

  protected $disallowed_format;

  public static function getInfo() {

    return array(

      'name' => 'Filter format access',

      'description' => 'Tests access to text formats.',

      'group' => 'Filter',

    );

  }

  function setUp() {

    parent::setUp();

    // Create a user who can administer text formats, but does not have

    // specific permission to use any of them.

    $this->filter_admin_user = $this->drupalCreateUser(array(

      'administer filters',

      'create page content',

      'edit any page content',

    ));

    // Create two text formats.

    $this->drupalLogin($this->filter_admin_user);

    $formats = array();

    for ($i = 0; $i < 2; $i++) {

      $edit = array(

        'format' => drupal_strtolower($this->randomName()),

        'name' => $this->randomName(),

      );

      $this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));

      $this->resetFilterCaches();

      $formats[] = filter_format_load($edit['format']);

    }

    list($this->allowed_format, $this->disallowed_format) = $formats;

    $this->drupalLogout();

    // Create a regular user with access to one of the formats.

    $this->web_user = $this->drupalCreateUser(array(

      'create page content',

      'edit any page content',

      filter_permission_name($this->allowed_format),

    ));

    // Create an administrative user who has access to use both formats.

    $this->admin_user = $this->drupalCreateUser(array(

      'administer filters',

      'create page content',

      'edit any page content',

      filter_permission_name($this->allowed_format),

      filter_permission_name($this->disallowed_format),

    ));

  }

  /**

   * Tests the Filter format access permissions functionality.

   */

  function testFormatPermissions() {

    // Make sure that a regular user only has access to the text format they

    // were granted access to, as well to the fallback format.

    $this->assertTrue(filter_access($this->allowed_format, $this->web_user), 'A regular user has access to a text format they were granted access to.');

    $this->assertFalse(filter_access($this->disallowed_format, $this->web_user), 'A regular user does not have access to a text format they were not granted access to.');

    $this->assertTrue(filter_access(filter_format_load(filter_fallback_format()), $this->web_user), 'A regular user has access to the fallback format.');

    // Perform similar checks as above, but now against the entire list of

    // available formats for this user.

    $this->assertTrue(in_array($this->allowed_format->format, array_keys(filter_formats($this->web_user))), 'The allowed format appears in the list of available formats for a regular user.');

    $this->assertFalse(in_array($this->disallowed_format->format, array_keys(filter_formats($this->web_user))), 'The disallowed format does not appear in the list of available formats for a regular user.');

    $this->assertTrue(in_array(filter_fallback_format(), array_keys(filter_formats($this->web_user))), 'The fallback format appears in the list of available formats for a regular user.');

    // Make sure that a regular user only has permission to use the format

    // they were granted access to.

    $this->assertTrue(user_access(filter_permission_name($this->allowed_format), $this->web_user), 'A regular user has permission to use the allowed text format.');

    $this->assertFalse(user_access(filter_permission_name($this->disallowed_format), $this->web_user), 'A regular user does not have permission to use the disallowed text format.');

    // Make sure that the allowed format appears on the node form and that

    // the disallowed format does not.

    $this->drupalLogin($this->web_user);

    $this->drupalGet('node/add/page');

    $langcode = LANGUAGE_NONE;

    $elements = $this->xpath('//select[@name=:name]/option', array(

      ':name' => "body[$langcode][0][format]",

      ':option' => $this->allowed_format->format,

    ));

    $options = array();

    foreach ($elements as $element) {

      $options[(string) $element['value']] = $element;

    }

    $this->assertTrue(isset($options[$this->allowed_format->format]), 'The allowed text format appears as an option when adding a new node.');

    $this->assertFalse(isset($options[$this->disallowed_format->format]), 'The disallowed text format does not appear as an option when adding a new node.');

    $this->assertTrue(isset($options[filter_fallback_format()]), 'The fallback format appears as an option when adding a new node.');

  }

  /**

   * Tests if text format is available to a role.

   */

  function testFormatRoles() {

    // Get the role ID assigned to the regular user; it must be the maximum.

    $rid = max(array_keys($this->web_user->roles));

    // Check that this role appears in the list of roles that have access to an

    // allowed text format, but does not appear in the list of roles that have

    // access to a disallowed text format.

    $this->assertTrue(in_array($rid, array_keys(filter_get_roles_by_format($this->allowed_format))), 'A role which has access to a text format appears in the list of roles that have access to that format.');

    $this->assertFalse(in_array($rid, array_keys(filter_get_roles_by_format($this->disallowed_format))), 'A role which does not have access to a text format does not appear in the list of roles that have access to that format.');

    // Check that the correct text format appears in the list of formats

    // available to that role.

    $this->assertTrue(in_array($this->allowed_format->format, array_keys(filter_get_formats_by_role($rid))), 'A text format which a role has access to appears in the list of formats available to that role.');

    $this->assertFalse(in_array($this->disallowed_format->format, array_keys(filter_get_formats_by_role($rid))), 'A text format which a role does not have access to does not appear in the list of formats available to that role.');

    // Check that the fallback format is always allowed.

    $this->assertEqual(filter_get_roles_by_format(filter_format_load(filter_fallback_format())), user_roles(), 'All roles have access to the fallback format.');

    $this->assertTrue(in_array(filter_fallback_format(), array_keys(filter_get_formats_by_role($rid))), 'The fallback format appears in the list of allowed formats for any role.');

  }

  /**

   * Tests editing a page using a disallowed text format.

   *

   * Verifies that regular users and administrators are able to edit a page, but

   * not allowed to change the fields which use an inaccessible text format.

   * Also verifies that fields which use a text format that does not exist can

   * be edited by administrators only, but that the administrator is forced to

   * choose a new format before saving the page.

   */

  function testFormatWidgetPermissions() {

    $langcode = LANGUAGE_NONE;

    $title_key = "title";

    $body_value_key = "body[$langcode][0][value]";

    $body_format_key = "body[$langcode][0][format]";

    // Create node to edit.

    $this->drupalLogin($this->admin_user);

    $edit = array();

    $edit['title'] = $this->randomName(8);

    $edit[$body_value_key] = $this->randomName(16);

    $edit[$body_format_key] = $this->disallowed_format->format;

    $this->drupalPost('node/add/page', $edit, t('Save'));

    $node = $this->drupalGetNodeByTitle($edit['title']);

    // Try to edit with a less privileged user.

    $this->drupalLogin($this->web_user);

    $this->drupalGet('node/' . $node->nid);

    $this->clickLink(t('Edit'));

    // Verify that body field is read-only and contains replacement value.

    $this->assertFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", t('This field has been disabled because you do not have sufficient permissions to edit it.'), 'Text format access denied message found.');

    // Verify that title can be changed, but preview displays original body.

    $new_edit = array();

    $new_edit['title'] = $this->randomName(8);

    $this->drupalPost(NULL, $new_edit, t('Preview'));

    $this->assertText($edit[$body_value_key], 'Old body found in preview.');

    // Save and verify that only the title was changed.

    $this->drupalPost(NULL, $new_edit, t('Save'));

    $this->assertNoText($edit['title'], 'Old title not found.');

    $this->assertText($new_edit['title'], 'New title found.');

    $this->assertText($edit[$body_value_key], 'Old body found.');

    // Check that even an administrator with "administer filters" permission

    // cannot edit the body field if they do not have specific permission to

    // use its stored format. (This must be disallowed so that the

    // administrator is never forced to switch the text format to something

    // else.)

    $this->drupalLogin($this->filter_admin_user);

    $this->drupalGet('node/' . $node->nid . '/edit');

    $this->assertFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", t('This field has been disabled because you do not have sufficient permissions to edit it.'), 'Text format access denied message found.');

    // Disable the text format used above.

    filter_format_disable($this->disallowed_format);

    $this->resetFilterCaches();

    // Log back in as the less privileged user and verify that the body field

    // is still disabled, since the less privileged user should not be able to

    // edit content that does not have an assigned format.

    $this->drupalLogin($this->web_user);

    $this->drupalGet('node/' . $node->nid . '/edit');

    $this->assertFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", t('This field has been disabled because you do not have sufficient permissions to edit it.'), 'Text format access denied message found.');

    // Log back in as the filter administrator and verify that the body field

    // can be edited.

    $this->drupalLogin($this->filter_admin_user);

    $this->drupalGet('node/' . $node->nid . '/edit');

    $this->assertNoFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", NULL, 'Text format access denied message not found.');

    $this->assertFieldByXPath("//select[@name='$body_format_key']", NULL, 'Text format selector found.');

    // Verify that trying to save the node without selecting a new text format

    // produces an error message, and does not result in the node being saved.

    $old_title = $new_edit['title'];

    $new_title = $this->randomName(8);

    $edit = array('title' => $new_title);

    $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));

    $this->assertText(t('!name field is required.', array('!name' => t('Text format'))), 'Error message is displayed.');

    $this->drupalGet('node/' . $node->nid);

    $this->assertText($old_title, 'Old title found.');

    $this->assertNoText($new_title, 'New title not found.');

    // Now select a new text format and make sure the node can be saved.

    $edit[$body_format_key] = filter_fallback_format();

    $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));

    $this->assertUrl('node/' . $node->nid);

    $this->assertText($new_title, 'New title found.');

    $this->assertNoText($old_title, 'Old title not found.');

    // Switch the text format to a new one, then disable that format and all

    // other formats on the site (leaving only the fallback format).

    $this->drupalLogin($this->admin_user);

    $edit = array($body_format_key => $this->allowed_format->format);

    $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));

    $this->assertUrl('node/' . $node->nid);

    foreach (filter_formats() as $format) {

      if ($format->format != filter_fallback_format()) {

        filter_format_disable($format);

      }

    }

    // Since there is now only one available text format, the widget for

    // selecting a text format would normally not display when the content is

    // edited. However, we need to verify that the filter administrator still

    // is forced to make a conscious choice to reassign the text to a different

    // format.

    $this->drupalLogin($this->filter_admin_user);

    $old_title = $new_title;

    $new_title = $this->randomName(8);

    $edit = array('title' => $new_title);

    $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));

    $this->assertText(t('!name field is required.', array('!name' => t('Text format'))), 'Error message is displayed.');

    $this->drupalGet('node/' . $node->nid);

    $this->assertText($old_title, 'Old title found.');

    $this->assertNoText($new_title, 'New title not found.');

    $edit[$body_format_key] = filter_fallback_format();

    $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));

    $this->assertUrl('node/' . $node->nid);

    $this->assertText($new_title, 'New title found.');

    $this->assertNoText($old_title, 'Old title not found.');

  }

  /**

   * Rebuilds text format and permission caches in the thread running the tests.

   */

  protected function resetFilterCaches() {

    filter_formats_reset();

    $this->checkPermissions(array(), TRUE);

  }

}

/**

 * Tests the default filter functionality in the Filter module.

 */

class FilterDefaultFormatTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Default text format functionality',

      'description' => 'Test the default text formats for different users.',

      'group' => 'Filter',

    );

  }

  /**

   * Tests if the default text format is accessible to users.

   */

  function testDefaultTextFormats() {

    // Create two text formats, and two users. The first user has access to

    // both formats, but the second user only has access to the second one.

    $admin_user = $this->drupalCreateUser(array('administer filters'));

    $this->drupalLogin($admin_user);

    $formats = array();

    for ($i = 0; $i < 2; $i++) {

      $edit = array(

        'format' => drupal_strtolower($this->randomName()),

        'name' => $this->randomName(),

      );

      $this->drupalPost('admin/config/content/formats/add', $edit, t('Save configuration'));

      $this->resetFilterCaches();

      $formats[] = filter_format_load($edit['format']);

    }

    list($first_format, $second_format) = $formats;

    $first_user = $this->drupalCreateUser(array(filter_permission_name($first_format), filter_permission_name($second_format)));

    $second_user = $this->drupalCreateUser(array(filter_permission_name($second_format)));

    // Adjust the weights so that the first and second formats (in that order)

    // are the two lowest weighted formats available to any user.

    $minimum_weight = db_query("SELECT MIN(weight) FROM {filter_format}")->fetchField();

    $edit = array();

    $edit['formats[' . $first_format->format . '][weight]'] = $minimum_weight - 2;

    $edit['formats[' . $second_format->format . '][weight]'] = $minimum_weight - 1;

    $this->drupalPost('admin/config/content/formats', $edit, t('Save changes'));

    $this->resetFilterCaches();

    // Check that each user's default format is the lowest weighted format that

    // the user has access to.

    $this->assertEqual(filter_default_format($first_user), $first_format->format, "The first user's default format is the lowest weighted format that the user has access to.");

    $this->assertEqual(filter_default_format($second_user), $second_format->format, "The second user's default format is the lowest weighted format that the user has access to, and is different than the first user's.");

    // Reorder the two formats, and check that both users now have the same

    // default.

    $edit = array();

    $edit['formats[' . $second_format->format . '][weight]'] = $minimum_weight - 3;

    $this->drupalPost('admin/config/content/formats', $edit, t('Save changes'));

    $this->resetFilterCaches();

    $this->assertEqual(filter_default_format($first_user), filter_default_format($second_user), 'After the formats are reordered, both users have the same default format.');

  }

  /**

   * Rebuilds text format and permission caches in the thread running the tests.

   */

  protected function resetFilterCaches() {

    filter_formats_reset();

    $this->checkPermissions(array(), TRUE);

  }

}

/**

 * Tests the behavior of check_markup() when it is called without text format.

 */

class FilterNoFormatTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Unassigned text format functionality',

      'description' => 'Test the behavior of check_markup() when it is called without a text format.',

      'group' => 'Filter',

    );

  }

  /**

   * Tests text without format.

   *

   * Tests if text with no format is filtered the same way as text in the

   * fallback format.

   */

  function testCheckMarkupNoFormat() {

    // Create some text. Include some HTML and line breaks, so we get a good

    // test of the filtering that is applied to it.

    $text = "<strong>" . $this->randomName(32) . "</strong>\n\n<div>" . $this->randomName(32) . "</div>";

    // Make sure that when this text is run through check_markup() with no text

    // format, it is filtered as though it is in the fallback format.

    $this->assertEqual(check_markup($text), check_markup($text, filter_fallback_format()), 'Text with no format is filtered the same as text in the fallback format.');

  }

}

/**

 * Security tests for missing/vanished text formats or filters.

 */

class FilterSecurityTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Security',

      'description' => 'Test the behavior of check_markup() when a filter or text format vanishes.',

      'group' => 'Filter',

    );

  }

  function setUp() {

    parent::setUp('php', 'filter_test');

    $this->admin_user = $this->drupalCreateUser(array('administer modules', 'administer filters', 'administer site configuration'));

    $this->drupalLogin($this->admin_user);

  }

  /**

   * Tests removal of filtered content when an active filter is disabled.

   *

   * Tests that filtered content is emptied when an actively used filter module

   * is disabled.

   */

  function testDisableFilterModule() {

    // Create a new node.

    $node = $this->drupalCreateNode(array('promote' => 1));

    $body_raw = $node->body[LANGUAGE_NONE][0]['value'];

    $format_id = $node->body[LANGUAGE_NONE][0]['format'];

    $this->drupalGet('node/' . $node->nid);

    $this->assertText($body_raw, 'Node body found.');

    // Enable the filter_test_replace filter.

    $edit = array(

      'filters[filter_test_replace][status]' => 1,

    );

    $this->drupalPost('admin/config/content/formats/' . $format_id, $edit, t('Save configuration'));

    // Verify that filter_test_replace filter replaced the content.

    $this->drupalGet('node/' . $node->nid);

    $this->assertNoText($body_raw, 'Node body not found.');

    $this->assertText('Filter: Testing filter', 'Testing filter output found.');

    // Disable the text format entirely.

    $this->drupalPost('admin/config/content/formats/' . $format_id . '/disable', array(), t('Disable'));

    // Verify that the content is empty, because the text format does not exist.

    $this->drupalGet('node/' . $node->nid);

    $this->assertNoText($body_raw, 'Node body not found.');

  }

}

/**

 * Unit tests for core filters.

 */

class FilterUnitTestCase extends DrupalUnitTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Filter module filters',

      'description' => 'Tests Filter module filters individually.',

      'group' => 'Filter',

    );

  }

  /**

   * Tests the line break filter.

   */

  function testLineBreakFilter() {

    // Setup dummy filter object.

    $filter = new stdClass();

    $filter->callback = '_filter_autop';

    // Since the line break filter naturally needs plenty of newlines in test

    // strings and expectations, we're using "\n" instead of regular newlines

    // here.

    $tests = array(

      // Single line breaks should be changed to <br /> tags, while paragraphs

      // separated with double line breaks should be enclosed with <p></p> tags.

      "aaa\nbbb\n\nccc" => array(

        "<p>aaa<br />\nbbb</p>\n<p>ccc</p>" => TRUE,

      ),

      // Skip contents of certain block tags entirely.

      "<script>aaa\nbbb\n\nccc</script>

<style>aaa\nbbb\n\nccc</style>

<pre>aaa\nbbb\n\nccc</pre>

<object>aaa\nbbb\n\nccc</object>

<iframe>aaa\nbbb\n\nccc</iframe>

" => array(

        "<script>aaa\nbbb\n\nccc</script>" => TRUE,

        "<style>aaa\nbbb\n\nccc</style>" => TRUE,

        "<pre>aaa\nbbb\n\nccc</pre>" => TRUE,

        "<object>aaa\nbbb\n\nccc</object>" => TRUE,

        "<iframe>aaa\nbbb\n\nccc</iframe>" => TRUE,

      ),

      // Skip comments entirely.

      "One. <!-- comment --> Two.\n<!--\nThree.\n-->\n" => array(

        '<!-- comment -->' => TRUE,

        "<!--\nThree.\n-->" => TRUE,

      ),

      // Resulting HTML should produce matching paragraph tags.

      '<p><div>  </div></p>' => array(

        "<p>\n<div>  </div>\n</p>" => TRUE,

      ),

      '<div><p>  </p></div>' => array(

        "<div>\n</div>" => TRUE,

      ),

      '<blockquote><pre>aaa</pre></blockquote>' => array(

        "<blockquote><pre>aaa</pre></blockquote>" => TRUE,

      ),

      "<pre>aaa\nbbb\nccc</pre>\nddd\neee" => array(

        "<pre>aaa\nbbb\nccc</pre>" => TRUE,

        "<p>ddd<br />\neee</p>" => TRUE,

      ),

      // Comments remain unchanged and subsequent lines/paragraphs are

      // transformed normally.

      "aaa<!--comment-->\n\nbbb\n\nccc\n\nddd<!--comment\nwith linebreak-->\n\neee\n\nfff" => array(

        "<p>aaa</p>\n<!--comment--><p>\nbbb</p>\n<p>ccc</p>\n<p>ddd</p>" => TRUE,

        "<!--comment\nwith linebreak--><p>\neee</p>\n<p>fff</p>" => TRUE,

      ),

      // Check that a comment in a PRE will result that the text after

      // the comment, but still in PRE, is not transformed.

      "<pre>aaa\nbbb<!-- comment -->\n\nccc</pre>\nddd" => array(

        "<pre>aaa\nbbb<!-- comment -->\n\nccc</pre>" => TRUE,

      ),

      // Bug 810824, paragraphs were appearing around iframe tags.

      "<iframe>aaa</iframe>\n\n" => array(

        "<p><iframe>aaa</iframe></p>" => FALSE,

      ),

    );

    $this->assertFilteredString($filter, $tests);

    // Very long string hitting PCRE limits.

    $limit = max(ini_get('pcre.backtrack_limit'), ini_get('pcre.recursion_limit'));

    $source = $this->randomName($limit);

    $result = _filter_autop($source);

    $success = $this->assertEqual($result, '<p>' . $source . "</p>\n", 'Line break filter can process very long strings.');

    if (!$success) {

      $this->verbose("\n" . $source . "\n<hr />\n" . $result);

    }

  }

  /**

   * Tests limiting allowed tags and XSS prevention.

   *

   * XSS tests assume that script is disallowed by default and src is allowed

   * by default, but on* and style attributes are disallowed.

   *

   * Script injection vectors mostly adopted from http://ha.ckers.org/xss.html.

   *

   * Relevant CVEs:

   * - CVE-2002-1806, ~CVE-2005-0682, ~CVE-2005-2106, CVE-2005-3973,

   *   CVE-2006-1226 (= rev. 1.112?), CVE-2008-0273, CVE-2008-3740.

   */

  function testFilterXSS() {

    // Tag stripping, different ways to work around removal of HTML tags.

    $f = filter_xss('<script>alert(0)</script>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping -- simple script without special characters.');

    $f = filter_xss('<script src="http://www.example.com" />');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping -- empty script with source.');

    $f = filter_xss('<ScRipt sRc=http://www.example.com/>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- varying case.');

    $f = filter_xss("<script\nsrc\n=\nhttp://www.example.com/\n>");

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- multiline tag.');

    $f = filter_xss('<script/a src=http://www.example.com/a.js></script>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- non whitespace character after tag name.');

    $f = filter_xss('<script/src=http://www.example.com/a.js></script>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no space between tag and attribute.');

    // Null between < and tag name works at least with IE6.

    $f = filter_xss("<\0scr\0ipt>alert(0)</script>");

    $this->assertNoNormalized($f, 'ipt', 'HTML tag stripping evasion -- breaking HTML with nulls.');

    $f = filter_xss("<scrscriptipt src=http://www.example.com/a.js>");

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- filter just removing "script".');

    $f = filter_xss('<<script>alert(0);//<</script>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- double opening brackets.');

    $f = filter_xss('<script src=http://www.example.com/a.js?<b>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no closing tag.');

    // DRUPAL-SA-2008-047: This doesn't seem exploitable, but the filter should

    // work consistently.

    $f = filter_xss('<script>>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- double closing tag.');

    $f = filter_xss('<script src=//www.example.com/.a>');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no scheme or ending slash.');

    $f = filter_xss('<script src=http://www.example.com/.a');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no closing bracket.');

    $f = filter_xss('<script src=http://www.example.com/ <');

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- opening instead of closing bracket.');

    $f = filter_xss('<nosuchtag attribute="newScriptInjectionVector">');

    $this->assertNoNormalized($f, 'nosuchtag', 'HTML tag stripping evasion -- unknown tag.');

    $f = filter_xss('<?xml:namespace ns="urn:schemas-microsoft-com:time">');

    $this->assertTrue(stripos($f, '<?xml') === FALSE, 'HTML tag stripping evasion -- starting with a question sign (processing instructions).');

    $f = filter_xss('<t:set attributeName="innerHTML" to="&lt;script defer&gt;alert(0)&lt;/script&gt;">');

    $this->assertNoNormalized($f, 't:set', 'HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).');

    $f = filter_xss('<img """><script>alert(0)</script>', array('img'));

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- a malformed image tag.');

    $f = filter_xss('<blockquote><script>alert(0)</script></blockquote>', array('blockquote'));

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- script in a blockqoute.');

    $f = filter_xss("<!--[if true]><script>alert(0)</script><![endif]-->");

    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- script within a comment.');

    // Dangerous attributes removal.

    $f = filter_xss('<p onmouseover="http://www.example.com/">', array('p'));

    $this->assertNoNormalized($f, 'onmouseover', 'HTML filter attributes removal -- events, no evasion.');

    $f = filter_xss('<li style="list-style-image: url(javascript:alert(0))">', array('li'));

    $this->assertNoNormalized($f, 'style', 'HTML filter attributes removal -- style, no evasion.');

    $f = filter_xss('<img onerror   =alert(0)>', array('img'));

    $this->assertNoNormalized($f, 'onerror', 'HTML filter attributes removal evasion -- spaces before equals sign.');

    $f = filter_xss('<img onabort!#$%&()*~+-_.,:;?@[/|\]^`=alert(0)>', array('img'));

    $this->assertNoNormalized($f, 'onabort', 'HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.');

    $f = filter_xss('<img oNmediAError=alert(0)>', array('img'));

    $this->assertNoNormalized($f, 'onmediaerror', 'HTML filter attributes removal evasion -- varying case.');

    // Works at least with IE6.

    $f = filter_xss("<img o\0nfocus\0=alert(0)>", array('img'));

    $this->assertNoNormalized($f, 'focus', 'HTML filter attributes removal evasion -- breaking with nulls.');

    // Only whitelisted scheme names allowed in attributes.

    $f = filter_xss('<img src="javascript:alert(0)">', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- no evasion.');

    $f = filter_xss('<img src=javascript:alert(0)>', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- no quotes.');

    // A bit like CVE-2006-0070.

    $f = filter_xss('<img src="javascript:confirm(0)">', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- no alert ;)');

    $f = filter_xss('<img src=`javascript:alert(0)`>', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- grave accents.');

    $f = filter_xss('<img dynsrc="javascript:alert(0)">', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- rare attribute.');

    $f = filter_xss('<table background="javascript:alert(0)">', array('table'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- another tag.');

    $f = filter_xss('<base href="javascript:alert(0);//">', array('base'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- one more attribute and tag.');

    $f = filter_xss('<img src="jaVaSCriPt:alert(0)">', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- varying case.');

    $f = filter_xss('<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#48;&#41;>', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- UTF-8 decimal encoding.');

    $f = filter_xss('<img src=&#00000106&#0000097&#00000118&#0000097&#00000115&#0000099&#00000114&#00000105&#00000112&#00000116&#0000058&#0000097&#00000108&#00000101&#00000114&#00000116&#0000040&#0000048&#0000041>', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- long UTF-8 encoding.');

    $f = filter_xss('<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x30&#x29>', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- UTF-8 hex encoding.');

    $f = filter_xss("<img src=\"jav\tascript:alert(0)\">", array('img'));

    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an embedded tab.');

    $f = filter_xss('<img src="jav&#x09;ascript:alert(0)">', array('img'));

    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an encoded, embedded tab.');

    $f = filter_xss('<img src="jav&#x000000A;ascript:alert(0)">', array('img'));

    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an encoded, embedded newline.');

    // With 
 this test would fail, but the entity gets turned into

    // 
, so it's OK.

    $f = filter_xss('<img src="jav&#x0D;ascript:alert(0)">', array('img'));

    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an encoded, embedded carriage return.');

    $f = filter_xss("<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">", array('img'));

    $this->assertNoNormalized($f, 'cript', 'HTML scheme clearing evasion -- broken into many lines.');

    $f = filter_xss("<img src=\"jav\0a\0\0cript:alert(0)\">", array('img'));

    $this->assertNoNormalized($f, 'cript', 'HTML scheme clearing evasion -- embedded nulls.');

    $f = filter_xss('<img src=" &#14;  javascript:alert(0)">', array('img'));

    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- spaces and metacharacters before scheme.');

    $f = filter_xss('<img src="vbscript:msgbox(0)">', array('img'));

    $this->assertNoNormalized($f, 'vbscript', 'HTML scheme clearing evasion -- another scheme.');

    $f = filter_xss('<img src="nosuchscheme:notice(0)">', array('img'));

    $this->assertNoNormalized($f, 'nosuchscheme', 'HTML scheme clearing evasion -- unknown scheme.');

    // Netscape 4.x javascript entities.

    $f = filter_xss('<br size="&{alert(0)}">', array('br'));

    $this->assertNoNormalized($f, 'alert', 'Netscape 4.x javascript entities.');

    // DRUPAL-SA-2008-006: Invalid UTF-8, these only work as reflected XSS with

    // Internet Explorer 6.

    $f = filter_xss("<p arg=\"\xe0\">\" style=\"background-image: url(javascript:alert(0));\"\xe0<p>", array('p'));

    $this->assertNoNormalized($f, 'style', 'HTML filter -- invalid UTF-8.');

    $f = filter_xss("\xc0aaa");

    $this->assertEqual($f, '', 'HTML filter -- overlong UTF-8 sequences.');

    $f = filter_xss("Who's Online");

    $this->assertNormalized($f, "who's online", 'HTML filter -- html entity number');

    $f = filter_xss("Who's Online");

    $this->assertNormalized($f, "who's online", 'HTML filter -- encoded html entity number');

    $f = filter_xss("Who' Online");

    $this->assertNormalized($f, "who' online", 'HTML filter -- double encoded html entity number');

  }

  /**

   * Tests filter settings, defaults, access restrictions and similar.

   *

   * @todo This is for functions like filter_filter and check_markup, whose

   *   functionality is not completely focused on filtering. Some ideas:

   *   restricting formats according to user permissions, proper cache

   *   handling, defaults -- allowed tags/attributes/protocols.

   *

   * @todo It is possible to add script, iframe etc. to allowed tags, but this

   *   makes HTML filter completely ineffective.

   *

   * @todo Class, id, name and xmlns should be added to disallowed attributes,

   *   or better a whitelist approach should be used for that too.

   */

  function testHtmlFilter() {

    // Setup dummy filter object.

    $filter = new stdClass();

    $filter->settings = array(

      'allowed_html' => '<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd> <test-element>',

      'filter_html_help' => 1,

      'filter_html_nofollow' => 0,

    );

    // HTML filter is not able to secure some tags, these should never be

    // allowed.

    $f = _filter_html('<script />', $filter);

    $this->assertNoNormalized($f, 'script', 'HTML filter should always remove script tags.');

    $f = _filter_html('<iframe />', $filter);

    $this->assertNoNormalized($f, 'iframe', 'HTML filter should always remove iframe tags.');

    $f = _filter_html('<object />', $filter);

    $this->assertNoNormalized($f, 'object', 'HTML filter should always remove object tags.');

    $f = _filter_html('<style />', $filter);

    $this->assertNoNormalized($f, 'style', 'HTML filter should always remove style tags.');

    // Some tags make CSRF attacks easier, let the user take the risk herself.

    $f = _filter_html('<img />', $filter);

    $this->assertNoNormalized($f, 'img', 'HTML filter should remove img tags on default.');

    $f = _filter_html('<input />', $filter);

    $this->assertNoNormalized($f, 'img', 'HTML filter should remove input tags on default.');

    // Filtering content of some attributes is infeasible, these shouldn't be

    // allowed too.

    $f = _filter_html('<p style="display: none;" />', $filter);

    $this->assertNoNormalized($f, 'style', 'HTML filter should remove style attribute on default.');

    $f = _filter_html('<p onerror="alert(0);" />', $filter);

    $this->assertNoNormalized($f, 'onerror', 'HTML filter should remove on* attributes on default.');

    $f = _filter_html('<code onerror>&nbsp;</code>', $filter);

    $this->assertNoNormalized($f, 'onerror', 'HTML filter should remove empty on* attributes on default.');

    // Custom tags are supported and should be allowed through.

    $f = _filter_html('<test-element></test-element>', $filter);

    $this->assertNormalized($f, 'test-element', 'HTML filter should allow custom elements.');

  }

  /**

   * Tests the spam deterrent.

   */

  function testNoFollowFilter() {

    // Setup dummy filter object.

    $filter = new stdClass();

    $filter->settings = array(

      'allowed_html' => '<a>',

      'filter_html_help' => 1,

      'filter_html_nofollow' => 1,

    );

    // Test if the rel="nofollow" attribute is added, even if we try to prevent

    // it.

    $f = _filter_html('<a href="http://www.example.com/">text</a>', $filter);

    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent -- no evasion.');

    $f = _filter_html('<A href="http://www.example.com/">text</a>', $filter);

    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- capital A.');

    $f = _filter_html("<a/href=\"http://www.example.com/\">text</a>", $filter);

    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- non whitespace character after tag name.');

    $f = _filter_html("<\0a\0 href=\"http://www.example.com/\">text</a>", $filter);

    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- some nulls.');

    $f = _filter_html('<a href="http://www.example.com/" rel="follow">text</a>', $filter);

    $this->assertNoNormalized($f, 'rel="follow"', 'Spam deterrent evasion -- with rel set - rel="follow" removed.');

    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- with rel set - rel="nofollow" added.');

  }

  /**

   * Tests the loose, admin HTML filter.

   */

  function testFilterXSSAdmin() {

    // DRUPAL-SA-2008-044

    $f = filter_xss_admin('<object />');

    $this->assertNoNormalized($f, 'object', 'Admin HTML filter -- should not allow object tag.');

    $f = filter_xss_admin('<script />');

    $this->assertNoNormalized($f, 'script', 'Admin HTML filter -- should not allow script tag.');

    $f = filter_xss_admin('<style /><iframe /><frame /><frameset /><meta /><link /><embed /><applet /><param /><layer />');

    $this->assertEqual($f, '', 'Admin HTML filter -- should never allow some tags.');

  }

  /**

   * Tests the HTML escaping filter.

   *

   * check_plain() is not tested here.

   */

  function testHtmlEscapeFilter() {

    // Setup dummy filter object.

    $filter = new stdClass();

    $filter->callback = '_filter_html_escape';

    $tests = array(

      "   One. <!-- \"comment\" --> Two'.\n<p>Three.</p>\n    " => array(

        "One. <!-- "comment" --> Two'.\n<p>Three.</p>" => TRUE,

        '   One.' => FALSE,

        "</p>\n    " => FALSE,

      ),

    );

    $this->assertFilteredString($filter, $tests);

  }

  /**

   * Tests the URL filter.

   */

  function testUrlFilter() {

    // Setup dummy filter object.

    $filter = new stdClass();

    $filter->callback = '_filter_url';

    $filter->settings = array(

      'filter_url_length' => 496,

    );

    // @todo Possible categories:

    // - absolute, mail, partial

    // - characters/encoding, surrounding markup, security

    // Create a e-mail that is too long.

    $long_email = str_repeat('a', 254) . '@example.com';

    $too_long_email = str_repeat('b', 255) . '@example.com';

    // Filter selection/pattern matching.

    $tests = array(

      // HTTP URLs.

      '

http://example.com or www.example.com

' => array(

        '<a href="http://example.com">http://example.com</a>' => TRUE,

        '<a href="http://www.example.com">www.example.com</a>' => TRUE,

      ),

      // MAILTO URLs.

      '

person@example.com or mailto:person2@example.com or ' . $long_email . ' but not ' . $too_long_email . '

' => array(

        '<a href="mailto:person@example.com">person@example.com</a>' => TRUE,

        '<a href="mailto:person2@example.com">mailto:person2@example.com</a>' => TRUE,

        '<a href="mailto:' . $long_email . '">' . $long_email . '</a>' => TRUE,

        '<a href="mailto:' . $too_long_email . '">' . $too_long_email . '</a>' => FALSE,

      ),

      // URI parts and special characters.

      '

http://trailingslash.com/ or www.trailingslash.com/

http://host.com/some/path?query=foo&bar[baz]=beer#fragment or www.host.com/some/path?query=foo&bar[baz]=beer#fragment

http://twitter.com/#!/example/status/22376963142324226

ftp://user:pass@ftp.example.com/~home/dir1

sftp://user@nonstandardport:222/dir

ssh://192.168.0.100/srv/git/drupal.git

' => array(

        '<a href="http://trailingslash.com/">http://trailingslash.com/</a>' => TRUE,

        '<a href="http://www.trailingslash.com/">www.trailingslash.com/</a>' => TRUE,

        '<a href="http://host.com/some/path?query=foo&amp;bar[baz]=beer#fragment">http://host.com/some/path?query=foo&amp;bar[baz]=beer#fragment</a>' => TRUE,

        '<a href="http://www.host.com/some/path?query=foo&amp;bar[baz]=beer#fragment">www.host.com/some/path?query=foo&amp;bar[baz]=beer#fragment</a>' => TRUE,

        '<a href="http://twitter.com/#!/example/status/22376963142324226">http://twitter.com/#!/example/status/22376963142324226</a>' => TRUE,

        '<a href="ftp://user:pass@ftp.example.com/~home/dir1">ftp://user:pass@ftp.example.com/~home/dir1</a>' => TRUE,

        '<a href="sftp://user@nonstandardport:222/dir">sftp://user@nonstandardport:222/dir</a>' => TRUE,

        '<a href="ssh://192.168.0.100/srv/git/drupal.git">ssh://192.168.0.100/srv/git/drupal.git</a>' => TRUE,

      ),

      // Encoding.

      '

http://ampersand.com/?a=1&b=2

http://encoded.com/?a=1&b=2

' => array(

        '<a href="http://ampersand.com/?a=1&amp;b=2">http://ampersand.com/?a=1&amp;b=2</a>' => TRUE,

        '<a href="http://encoded.com/?a=1&amp;b=2">http://encoded.com/?a=1&amp;b=2</a>' => TRUE,

      ),

      // Domain name length.

      '

www.ex.ex or www.example.example or www.toolongdomainexampledomainexampledomainexampledomainexampledomain or

me@me.tv

' => array(

        '<a href="http://www.ex.ex">www.ex.ex</a>' => TRUE,

        '<a href="http://www.example.example">www.example.example</a>' => TRUE,

        'http://www.toolong' => FALSE,

        '<a href="mailto:me@me.tv">me@me.tv</a>' => TRUE,

      ),

      // Absolute URL protocols.

      // The list to test is found in the beginning of _filter_url() at

      // $protocols = variable_get('filter_allowed_protocols'... (approx line 1325).

      '

https://example.com,

ftp://ftp.example.com,

news://example.net,

telnet://example,

irc://example.host,

ssh://odd.geek,

sftp://secure.host?,

webcal://calendar,

rtsp://127.0.0.1,

not foo://disallowed.com.

' => array(

        'href="https://example.com"' => TRUE,

        'href="ftp://ftp.example.com"' => TRUE,

        'href="news://example.net"' => TRUE,

        'href="telnet://example"' => TRUE,

        'href="irc://example.host"' => TRUE,

        'href="ssh://odd.geek"' => TRUE,

        'href="sftp://secure.host"' => TRUE,

        'href="webcal://calendar"' => TRUE,

        'href="rtsp://127.0.0.1"' => TRUE,

        'href="foo://disallowed.com"' => FALSE,

        'not foo://disallowed.com.' => TRUE,

      ),

    );

    $this->assertFilteredString($filter, $tests);

    // Surrounding text/punctuation.

    $tests = array(

      '

Partial URL with trailing period www.partial.com.

E-mail with trailing comma person@example.com,

Absolute URL with trailing question http://www.absolute.com?

Query string with trailing exclamation www.query.com/index.php?a=!

Partial URL with 3 trailing www.partial.periods...

E-mail with 3 trailing exclamations@example.com!!!

Absolute URL and query string with 2 different punctuation characters (http://www.example.com/q=abc).

' => array(

        'period <a href="http://www.partial.com">www.partial.com</a>.' => TRUE,

        'comma <a href="mailto:person@example.com">person@example.com</a>,' => TRUE,

        'question <a href="http://www.absolute.com">http://www.absolute.com</a>?' => TRUE,

        'exclamation <a href="http://www.query.com/index.php?a=">www.query.com/index.php?a=</a>!' => TRUE,

        'trailing <a href="http://www.partial.periods">www.partial.periods</a>...' => TRUE,

        'trailing <a href="mailto:exclamations@example.com">exclamations@example.com</a>!!!' => TRUE,

        'characters (<a href="http://www.example.com/q=abc">http://www.example.com/q=abc</a>).' => TRUE,

      ),

      '

(www.parenthesis.com/dir?a=1&b=2#a)

' => array(

        '(<a href="http://www.parenthesis.com/dir?a=1&amp;b=2#a">www.parenthesis.com/dir?a=1&amp;b=2#a</a>)' => TRUE,

      ),

    );

    $this->assertFilteredString($filter, $tests);

    // Surrounding markup.

    $tests = array(

      '

<p xmlns="www.namespace.com" />

<p xmlns="http://namespace.com">

An <a href="http://example.com" title="Read more at www.example.info...">anchor</a>.

</p>

' => array(

        '<p xmlns="www.namespace.com" />' => TRUE,

        '<p xmlns="http://namespace.com">' => TRUE,

        'href="http://www.namespace.com"' => FALSE,

        'href="http://namespace.com"' => FALSE,

        'An <a href="http://example.com" title="Read more at www.example.info...">anchor</a>.' => TRUE,

      ),

      '

Not <a href="foo">www.relative.com</a> or <a href="http://absolute.com">www.absolute.com</a>

but <strong>http://www.strong.net</strong> or <em>www.emphasis.info</em>

' => array(

        '<a href="foo">www.relative.com</a>' => TRUE,

        'href="http://www.relative.com"' => FALSE,

        '<a href="http://absolute.com">www.absolute.com</a>' => TRUE,

        '<strong><a href="http://www.strong.net">http://www.strong.net</a></strong>' => TRUE,

        '<em><a href="http://www.emphasis.info">www.emphasis.info</a></em>' => TRUE,

      ),

      '

Test <code>using www.example.com the code tag</code>.

' => array(

        'href' => FALSE,

        'http' => FALSE,

      ),

      '

Intro.

<blockquote>

Quoted text linking to www.example.com, written by person@example.com, originating from http://origin.example.com. <code>@see www.usage.example.com or <em>www.example.info</em> bla bla</code>.

</blockquote>

Outro.

' => array(

        'href="http://www.example.com"' => TRUE,

        'href="mailto:person@example.com"' => TRUE,

        'href="http://origin.example.com"' => TRUE,

        'http://www.usage.example.com' => FALSE,

        'http://www.example.info' => FALSE,

        'Intro.' => TRUE,

        'Outro.' => TRUE,

      ),

      '

Unknown tag <x>containing x and www.example.com</x>? And a tag <pooh>beginning with p and containing www.example.pooh with p?</pooh>

' => array(

        'href="http://www.example.com"' => TRUE,

        'href="http://www.example.pooh"' => TRUE,

      ),

      '

<p>Test &lt;br/&gt;: This is a www.example17.com example <strong>with</strong> various http://www.example18.com tags. *<br/>

 It is important www.example19.com to *<br/>test different URLs and http://www.example20.com in the same paragraph. *<br>

HTML www.example21.com soup by person@example22.com can litererally http://www.example23.com contain *img*<img> anything. Just a www.example24.com with http://www.example25.com thrown in. www.example26.com from person@example27.com with extra http://www.example28.com.

' => array(

        'href="http://www.example17.com"' => TRUE,

        'href="http://www.example18.com"' => TRUE,

        'href="http://www.example19.com"' => TRUE,

        'href="http://www.example20.com"' => TRUE,

        'href="http://www.example21.com"' => TRUE,

        'href="mailto:person@example22.com"' => TRUE,

        'href="http://www.example23.com"' => TRUE,

        'href="http://www.example24.com"' => TRUE,

        'href="http://www.example25.com"' => TRUE,

        'href="http://www.example26.com"' => TRUE,

        'href="mailto:person@example27.com"' => TRUE,

        'href="http://www.example28.com"' => TRUE,

      ),

      '

<script>

<!--

  // @see www.example.com

  var exampleurl = "http://example.net";

-->

<!--//--><![CDATA[//><!--

  // @see www.example.com

  var exampleurl = "http://example.net";

//--><!]]>

</script>

' => array(

        'href="http://www.example.com"' => FALSE,

        'href="http://example.net"' => FALSE,

      ),

      '

<style>body {

  background: url(http://example.com/pixel.gif);

}</style>

' => array(

        'href' => FALSE,

      ),

      '

<!-- Skip any URLs like www.example.com in comments -->

' => array(

        'href' => FALSE,

      ),

      '

<!-- Skip any URLs like

www.example.com with a newline in comments -->

' => array(

        'href' => FALSE,

      ),

      '

<!-- Skip any URLs like www.comment.com in comments. <p>Also ignore http://commented.out/markup.</p> -->

' => array(

        'href' => FALSE,

      ),

      '

<dl>

<dt>www.example.com</dt>

<dd>http://example.com</dd>

<dd>person@example.com</dd>

<dt>Check www.example.net</dt>

<dd>Some text around http://www.example.info by person@example.info?</dd>

</dl>

' => array(

        'href="http://www.example.com"' => TRUE,

        'href="http://example.com"' => TRUE,

        'href="mailto:person@example.com"' => TRUE,

        'href="http://www.example.net"' => TRUE,

        'href="http://www.example.info"' => TRUE,

        'href="mailto:person@example.info"' => TRUE,

      ),

      '

<div>www.div.com</div>

<ul>

<li>http://listitem.com</li>

<li class="odd">www.class.listitem.com</li>

</ul>

' => array(

        '<div><a href="http://www.div.com">www.div.com</a></div>' => TRUE,

        '<li><a href="http://listitem.com">http://listitem.com</a></li>' => TRUE,

        '<li class="odd"><a href="http://www.class.listitem.com">www.class.listitem.com</a></li>' => TRUE,

      ),

    );

    $this->assertFilteredString($filter, $tests);

    // URL trimming.

    $filter->settings['filter_url_length'] = 20;

    $tests = array(

      'www.trimmed.com/d/ff.ext?a=1&b=2#a1' => array(

        '<a href="http://www.trimmed.com/d/ff.ext?a=1&amp;b=2#a1">www.trimmed.com/d/ff...</a>' => TRUE,

      ),

    );

    $this->assertFilteredString($filter, $tests);

  }

  /**

   * Asserts multiple filter output expectations for multiple input strings.

   *

   * @param $filter

   *   A input filter object.

   * @param $tests

   *   An associative array, whereas each key is an arbitrary input string and

   *   each value is again an associative array whose keys are filter output

   *   strings and whose values are Booleans indicating whether the output is

   *   expected or not.

   *

   * For example:

   * @code

   * $tests = array(

   *   'Input string' => array(

   *     '<p>Input string</p>' => TRUE,

   *     'Input string<br' => FALSE,

   *   ),

   * );

   * @endcode

   */

  function assertFilteredString($filter, $tests) {

    foreach ($tests as $source => $tasks) {

      $function = $filter->callback;

      $result = $function($source, $filter);

      foreach ($tasks as $value => $is_expected) {

        // Not using assertIdentical, since combination with strpos() is hard to grok.

        if ($is_expected) {

          $success = $this->assertTrue(strpos($result, $value) !== FALSE, format_string('@source: @value found.', array(

            '@source' => var_export($source, TRUE),

            '@value' => var_export($value, TRUE),

          )));

        }

        else {

          $success = $this->assertTrue(strpos($result, $value) === FALSE, format_string('@source: @value not found.', array(

            '@source' => var_export($source, TRUE),

            '@value' => var_export($value, TRUE),

          )));

        }