Revision 20080724215437-9043f-dcd37e...

    @text = sanitize(input)

    @text = input

  ELEMENT_WHITELIST = HTML5::HTMLSanitizeModule::ALLOWED_ELEMENTS -

                      %w{form input thead tbody label} +

                      %w{nowiki ruby rp rb rt}

  ATTRIBUTE_WHITELIST = HTML5::HTMLSanitizeModule::ALLOWED_ATTRIBUTES + %w{face}

    next_char = @text[@cursor + 1]

    scanner = StringScanner.new(@text[@cursor .. -1])

    if next_char == 47

    if scanner.scan(%r{<(\/?)([^\s<>\/]+)([^>]*)>})

      # Might be an XHTML end tag

      #XHTML start or end tag, or just something surrounded by angle brackets

      if @text[@cursor .. -1] =~ %r{</([a-zA-Z][a-zA-Z0-9\-_]*)(\s*)>} and @context.include?(:TAG)

      tag_close_char, tag_name, attrs_string = scanner[1], scanner[2], scanner[3]

        # Found an XHTML end tag

      if ELEMENT_WHITELIST.include?(tag_name.downcase)

        tag_name = $1

        if tag_close_char == '/' and @context.include?(:TAG)

        end_span(:TAG, $1)

          # Found an XHTML end tag

        @lexer_table.pop

          end_span(:TAG, tag_name)

        @cursor += $1.length + $2.length + 3

          @lexer_table.pop

      else

        elsif tag_close_char.empty?

        match_text

      end

    elsif next_char > 64 and next_char < 123

      # Might be an XHTML open or empty tag

      scanner = StringScanner.new(@text[@cursor .. -1])

      if scanner.scan(%r{<([a-zA-Z][a-zA-Z0-9\-_]*)})

        # Sequence begins with a valid tag name, so check for attributes

        tag_name = scanner[1]

        attrs = {}

        while scanner.scan(%r{\s+([a-zA-Z][a-zA-Z0-9\-_]*)\s*=\s*('([^']+)'|"([^"]+)")}) do

          attrs[scanner[1]] = scanner[3] ? scanner[3] : scanner[4]

        end

        scanner.scan(%r{\s*})

        if ((c = scanner.get_byte) == '>' or (c == '/' and scanner.get_byte == '>'))

            @lexer_table.push(@nowiki_lexer_table) unless c == '/'

            @lexer_table.push(@nowiki_lexer_table) unless empty_tag

            if c == '/'

            if empty_tag then

          @cursor += scanner.pos

        else        

        else

          append_to_tokens([:CHAR_ENT, 'lt'])

          match_text

          append_to_tokens([:TEXT, tag_close_char + tag_name + attrs_string])

        end

          append_to_tokens([:CHAR_ENT, 'gt'])

        end 

        match_text

        append_to_tokens([:CHAR_ENT, 'lt'])

        append_to_tokens([:TEXT, tag_close_char + tag_name + attrs_string])

        append_to_tokens([:CHAR_ENT, 'gt'])

    assert_no_sanitization "This is very <u>important</u>, but that

    assert_no_sanitization "This is very <u>important</u>, but that " +

                            can <s>safely</s> be <strike>ignored</strike>"

                           "can <s>safely</s> be <strike>ignored</strike>"

    assert_no_sanitization %{<cite>"Perfection is achieved, not when there is

    assert_no_sanitization  "<cite>Perfection is achieved, not when there is" +

                                    nothing left to add, but when there is

                                  " nothing left to add, but when there is" +

                                    nothing left to remove."</cite>

                                  " nothing left to remove.</cite>" +

                             -- Antoine de Saint-Exupery}

                            " -- Antoine de Saint-Exupery"

    assert_no_sanitization "Text inside <code>code</code> and <tt>teletype</tt>

    assert_no_sanitization "Text inside <code>code</code> and <tt>teletype</tt> " +

                            usually get rendered with a fixed width font"

                           "usually get rendered with a fixed width font"

    assert_no_sanitization %{Most environments will render

    assert_no_sanitization "Most environments will render " +

                             <span style="color: red">this text</span> with

                           "<span style=\"color: red\">this text</span> with " +

                             different colours}

                           "different colours"

    assert_no_sanitization "<h1>Heading 1</h1>

    assert_no_sanitization "<h1>Heading 1</h1>" +

                            <h2>Heading 2</h2>

                           "<h2>Heading 2</h2>" +

                            <h3>Heading 3</h3>

                           "<h3>Heading 3</h3>" +

                            <h4>Heading 4</h4>

                           "<h4>Heading 4</h4>" +

                            <h5>Heading 5</h5>

                           "<h5>Heading 5</h5>" +

                            <h6>Heading 6</h6>"

                           "<h6>Heading 6</h6>"

    assert_no_sanitization "<ol>

    assert_no_sanitization "<ol>" +

                              <li>Ordered</li>

                             "<li>Ordered</li>" +

                              <li>List</li>

                             "<li>List</li>" +

                              <li>(And list items)</li>

                             "<li>(And list items)</li>" +

                            </ol>

                           "</ol>" +

                           "<ul>" +

                            <ul>

                             "<li>Unordered</li>" +

                              <li>Unordered</li>

                             "<li>List</li>" +

                              <li>List</li>

                             "<li>(And list items)</li>" +

                              <li>(And list items)</li>

                           "</ul>"

                            </ul>"

    assert_no_sanitization "<table>

    assert_no_sanitization "<table>" +

                              <tr><th>Table</th>    <th>tag</th>   <th /></tr>

                             "<tr><th>Table</th>    <th>tag</th>   <th /></tr>" +

                              <tr><td>and</td>      <td>its</td>   <td>components</td></tr>

                             "<tr><td>and</td>      <td>its</td>   <td>components</td></tr>" +

                              <tr><td>including</td><td>header</td><td>tags</td></tr>

                             "<tr><td>including</td><td>header</td><td>tags</td></tr>" +

                            </table>"

                           "</table>"

    assert_no_sanitization "<ruby>

    assert_no_sanitization "<ruby>" +

                              <rb>Ruby base</rb>

                             "<rb>Ruby base</rb>" +

                              <rp>(</rp>

                             "<rp>(</rp>" +

                              <rt>Ruby text</rt>

                             "<rt>Ruby text</rt>" +

                              <rp>)</rp>

                             "<rp>)</rp>" +

                            </ruby>"

                           "</ruby>"

    assert_no_sanitization "Break lines with an empty element<br /><br/>

    assert_no_sanitization "Break lines with an empty element<br /><br/>"

                            Or using the opening tag only <br>"

    assert_no_sanitization "<dl>

    assert_no_sanitization "<dl>" +

                              <dt>Definition terms</dt>

                             "<dt>Definition terms</dt>" +

                              <dd>And descriptions</dt>

                             "<dd>And descriptions</dd>" +

                            </dl>"

                           "</dl>"

  def test_keeps_nowiki_tags

  def test_keeps_nowiki_tags_and_sanitizes_inside

    assert_no_sanitization "<nowiki>No wiki tag</nowiki>"

    assert_sanitizes_to "No <yy>wiki</yy> ''tag''",

                        "<nowiki>No <yy>wiki</yy> ''tag''</nowiki>"

    assert_sanitizes_to %{<form action="/send" method="post">

    assert_sanitizes_to "<form action="/send" method="post">" +

                            <label for="username">Username</label>

                           "<label for="username">Username</label>" +

                            <input name="login" id="username" />

                           "<input name="login" id="username" />" +

                          </form>},

                         "</form>",

                        %{<form action="/send" method="post">

                        "<form action=\"/send\" method=\"post\">" +

                            <label for="username">Username</label>

                          "<label for=\"username\">Username</label>" +

                            <input name="login" id="username" />

                          "<input name=\"login\" id=\"username\" />" +

                          </form>}

                        "</form>"

    assert_sanitizes_to %{Here is some <b  >bold</b> and <em>emphasized</em  >

    assert_sanitizes_to "Here is some <b  >bold</b> and <em>emphasized</em  >" +

                          text. But <script type="text/javascript"  >alert('scripts')</script   >

                        " text. But <script type="text/javascript"  >" +

                          get sanitized},

                         "alert('scripts')</script   > get sanitized",

                        %{Here is some <b  >bold</b> and <em>emphasized</em  >

                        "Here is some <b  >bold</b> and <em>emphasized</em  >" +

                          text. But <script type="text/javascript"  >alert('scripts')</script   >

                        " text. But <script type=\"text/javascript\"  >" + 

                          get sanitized}

                         "alert('scripts')</script   > get sanitized"

    assert_no_sanitization "<SUP>Superscript</sup> and <CODE>code</CODE>"

    assert_no_sanitization "<SUP>Superscript</SUP> and <CODE>code</CODE>"

    assert_equal expected, @@lexer.sanitize(actual)

    assert_generates("<p>#{expected}</p>", actual)