@@ -39,8 +39,28 @@ def test_should_allow_relative_uris():
3939assert expected == sanitized
4040
4141
42+ def test_invalid_data_uri ():
43+ sanitized = sanitize_html ('<audio controls="" src="data:foobar"></audio>' )
44+ expected = '<audio controls></audio>'
45+ assert expected == sanitized
46+
47+
48+ def test_invalid_ipv6_url ():
49+ sanitized = sanitize_html ('<a href="h://]">' )
50+ expected = "<a></a>"
51+ assert expected == sanitized
52+
53+
54+ def test_data_uri_disallowed_type ():
55+ sanitized = sanitize_html ('<audio controls="" src="data:text/html,<html>"></audio>' )
56+ expected = "<audio controls></audio>"
57+ assert expected == sanitized
58+
59+
4260def test_sanitizer ():
4361for ns ,tag_name in sanitizer .allowed_elements :
62+ if ns != constants .namespaces ["html" ]:
63+ continue
4464if tag_name in ['caption' ,'col' ,'colgroup' ,'optgroup' ,'option' ,'table' ,'tbody' ,'td' ,'tfoot' ,'th' ,'thead' ,'tr' ]:
4565continue # TODO
4666if tag_name != tag_name .lower ():
@@ -63,6 +83,8 @@ def test_sanitizer():
6383"<%s title='1'>foo <bad>bar</bad> baz</%s>" % (tag_name ,tag_name ))
6484
6585for ns ,attribute_name in sanitizer .allowed_attributes :
86+ if ns != None :
87+ continue
6688if attribute_name != attribute_name .lower ():
6789continue # TODO
6890if attribute_name == 'style' :
@@ -82,18 +104,6 @@ def test_sanitizer():
82104"<img src=\" %s:%s\" >foo</a>" % (protocol ,rest_of_uri ),
83105"""<img src="%s:%s">foo</a>""" % (protocol ,rest_of_uri ))
84106
85- yield (runSanitizerTest ,"test_invalid_data_uri" ,
86- "<audio controls=\" \" ></audio>" ,
87- "<audio controls=\" \" src=\" data:foobar\" ></audio>" )
88-
89- yield (runSanitizerTest ,"test_invalid_ipv6_url" ,
90- "<a>" ,
91- "<a href=\" h://]\" >" )
92-
93- yield (runSanitizerTest ,"test_data_uri_disallowed_type" ,
94- "<audio controls=\" \" ></audio>" ,
95- "<audio controls=\" \" src=\" data:text/html,<html>\" ></audio>" )
96-
97107for protocol in sanitizer .allowed_protocols :
98108rest_of_uri = '//sub.domain.tld/path/object.ext'
99109if protocol == 'data' :