X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=tests%2Fphpunit%2Fincludes%2FSanitizerTest.php;h=c593d2f1bf71ce01680ac1111216a956500f183e;hb=312c7f2c1a05795c40af44e2c40700d4ee2489b4;hp=d67f905942f6c8c11cc7edf15ea66e95fbf4c187;hpb=218d50c0c3ba3af7843bff32fca9f1eec74925b6;p=lhc%2Fweb%2Fwiklou.git

diff --git a/tests/phpunit/includes/SanitizerTest.php b/tests/phpunit/includes/SanitizerTest.php
index d67f905942..c593d2f1bf 100644
--- a/tests/phpunit/includes/SanitizerTest.php
+++ b/tests/phpunit/includes/SanitizerTest.php
@@ -2,7 +2,11 @@
 
 class SanitizerTest extends MediaWikiTestCase {
 
-	function setUp() {
+	protected function setUp() {
+		parent::setUp();
+
+		$this->setMwGlobals( 'wgCleanupPresentationalAttributes', true );
+
 		AutoLoader::loadClass( 'Sanitizer' );
 	}
 
@@ -110,20 +114,22 @@ class SanitizerTest extends MediaWikiTestCase {
 		$this->assertEquals( Sanitizer::decodeTagAttributes( 'foo=&foobar;' ), array( 'foo' => '&foobar;' ), 'Entity-like items are accepted' );
 	}
 
-	function testDeprecatedAttributesDisabled() {
-		$GLOBALS['wgCleanupPresentationalAttributes'] = false;
-		$this->assertEquals( ' clear="left"', Sanitizer::fixTagAttributes( 'clear="left"', 'br' ), 'Deprecated attributes are not converted to styles when enabled.' );
-	}
-
 	/**
 	 * @dataProvider provideDeprecatedAttributes
 	 */
 	function testDeprecatedAttributes( $input, $tag, $expected, $message = null ) {
-		$GLOBALS['wgCleanupPresentationalAttributes'] = true;
 		$this->assertEquals( $expected, Sanitizer::fixTagAttributes( $input, $tag ), $message );
 	}
 
-	function provideDeprecatedAttributes() {
+	function testDeprecatedAttributesDisabled() {
+		global $wgCleanupPresentationalAttributes;
+
+		$wgCleanupPresentationalAttributes = false;
+
+		$this->assertEquals( ' clear="left"', Sanitizer::fixTagAttributes( 'clear="left"', 'br' ), 'Deprecated attributes are not converted to styles when enabled.' );
+	}
+
+	public static function provideDeprecatedAttributes() {
 		return array(
 			array( 'clear="left"', 'br', ' style="clear: left;"', 'Deprecated attributes are converted to styles when enabled.' ),
 			array( 'clear="all"', 'br', ' style="clear: both;"', 'clear=all is converted to clear: both; not clear: all;' ),
@@ -170,7 +176,7 @@ class SanitizerTest extends MediaWikiTestCase {
 		);
 	}
 
-	function provideCssCommentsFixtures() {
+	public static function provideCssCommentsFixtures() {
 		/** array( <expected>, <css>, [message] ) */
 		return array(
 			array( ' ', '/**/' ),
@@ -182,6 +188,12 @@ class SanitizerTest extends MediaWikiTestCase {
 	 			'Remove anything after a comment-start token' ),
 			array( '', "\\2f\\2a unifinished comment'",
 	 			'Remove anything after a backslash-escaped comment-start token' ),
+			array( '/* insecure input */', 'filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src=\'asdf.png\',sizingMethod=\'scale\');'),
+			array( '/* insecure input */', '-ms-filter: "progid:DXImageTransform.Microsoft.AlphaImageLoader(src=\'asdf.png\',sizingMethod=\'scale\')";'),
+			array( '/* insecure input */', 'width: expression(1+1);'),
+			array( '/* insecure input */', 'background-image: image(asdf.png);'),
+			array( '/* insecure input */', 'background-image: -webkit-image(asdf.png);'),
+			array( '/* insecure input */', 'background-image: -moz-image(asdf.png);'),
 		);
 	}
 }