fixup! Reintroduce the old sanitizer testsuite from html5lib-tests

Author: gsnedders

html5lib/tests/sanitizer-testdata/tests1.dat

@@ -8,7 +8,7 @@
   {
     "name": "IE_Comments_2",
     "input": "<![if !IE 5]><script>alert('XSS');</script><![endif]>",
-    "output": "&lt;script&gt;alert('XSS');&lt;/script&gt;",
+    "output": "&lt;script&gt;alert('XSS');&lt;/script&gt;"
   },
 
   {
@@ -20,13 +20,13 @@
   {
     "name": "background_attribute",
     "input": "<div background=\"javascript:alert('XSS')\"></div>",
-    "output": "<div/>",
+    "output": "<div/>"
   },
 
   {
     "name": "bgsound",
     "input": "<bgsound src=\"javascript:alert('XSS');\" />",
-    "output": "&lt;bgsound src=\"javascript:alert('XSS');\"/&gt;",
+    "output": "&lt;bgsound src=\"javascript:alert('XSS');\"/&gt;"
   },
 
   {
@@ -44,49 +44,49 @@
   {
     "name": "double_open_angle_brackets",
     "input": "<img src=http://ha.ckers.org/scriptlet.html <",
-    "output": "<img src='http://ha.ckers.org/scriptlet.html'>",
+    "output": "<img src='http://ha.ckers.org/scriptlet.html'>"
   },
 
   {
     "name": "double_open_angle_brackets_2",
     "input": "<script src=http://ha.ckers.org/scriptlet.html <",
-    "output": "&lt;script src=\"http://ha.ckers.org/scriptlet.html\" &lt;=\"\"&gt;",
+    "output": "&lt;script src=\"http://ha.ckers.org/scriptlet.html\" &lt;=\"\"&gt;"
   },
 
   {
     "name": "grave_accents",
     "input": "<img src=`javascript:alert('XSS')` />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "img_dynsrc_lowsrc",
     "input": "<img dynsrc=\"javascript:alert('XSS')\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "img_vbscript",
     "input": "<img src='vbscript:msgbox(\"XSS\")' />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "input_image",
     "input": "<input type=\"image\" src=\"javascript:alert('XSS');\" />",
-    "output": "<input type='image'/>",
+    "output": "<input type='image'/>"
   },
 
   {
     "name": "link_stylesheets",
     "input": "<link rel=\"stylesheet\" href=\"javascript:alert('XSS');\" />",
-    "output": "&lt;link rel=\"stylesheet\" href=\"javascript:alert('XSS');\"/&gt;",
+    "output": "&lt;link rel=\"stylesheet\" href=\"javascript:alert('XSS');\"/&gt;"
   },
 
   {
     "name": "link_stylesheets_2",
     "input": "<link rel=\"stylesheet\" href=\"http://ha.ckers.org/xss.css\" />",
-    "output": "&lt;link rel=\"stylesheet\" href=\"http://ha.ckers.org/xss.css\"/&gt;",
+    "output": "&lt;link rel=\"stylesheet\" href=\"http://ha.ckers.org/xss.css\"/&gt;"
   },
 
   {
@@ -98,37 +98,37 @@
   {
     "name": "no_closing_script_tags",
     "input": "<script src=http://ha.ckers.org/xss.js?<b>",
-    "output": "&lt;script src=\"http://ha.ckers.org/xss.js?&amp;lt;b\"&gt;",
+    "output": "&lt;script src=\"http://ha.ckers.org/xss.js?&amp;lt;b\"&gt;"
   },
 
   {
     "name": "non_alpha_non_digit",
     "input": "<script/XSS src=\"http://ha.ckers.org/xss.js\"></script>",
-    "output": "&lt;script XSS=\"\" src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;",
+    "output": "&lt;script XSS=\"\" src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;"
   },
 
   {
     "name": "non_alpha_non_digit_2",
     "input": "<a onclick!\\#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>foo</a>",
-    "output": "<a>foo</a>",
+    "output": "<a>foo</a>"
   },
 
   {
     "name": "non_alpha_non_digit_3",
     "input": "<img/src=\"http://ha.ckers.org/xss.js\"/>",
-    "output": "<img src='http://ha.ckers.org/xss.js'/>",
+    "output": "<img src='http://ha.ckers.org/xss.js'/>"
   },
 
   {
     "name": "non_alpha_non_digit_II",
     "input": "<a href!\\#$%&()*~+-_.,:;?@[/|]^`=alert('XSS')>foo</a>",
-    "output": "<a>foo</a>",
+    "output": "<a>foo</a>"
   },
 
   {
     "name": "non_alpha_non_digit_III",
     "input": "<a/href=\"javascript:alert('XSS');\">foo</a>",
-    "output": "<a>foo</a>",
+    "output": "<a>foo</a>"
   },
 
   {
@@ -140,7 +140,7 @@
   {
     "name": "protocol_resolution_in_script_tag",
     "input": "<script src=//ha.ckers.org/.j></script>",
-    "output": "&lt;script src=\"//ha.ckers.org/.j\"&gt;&lt;/script&gt;",
+    "output": "&lt;script src=\"//ha.ckers.org/.j\"&gt;&lt;/script&gt;"
   },
 
   {
@@ -152,25 +152,25 @@
   {
     "name": "should_allow_image_alt_attribute",
     "input": "<img alt='foo' onclick='bar' />",
-    "output": "<img alt='foo'/>",
+    "output": "<img alt='foo'/>"
   },
 
   {
     "name": "should_allow_image_height_attribute",
     "input": "<img height='foo' onclick='bar' />",
-    "output": "<img height='foo'/>",
+    "output": "<img height='foo'/>"
   },
 
   {
     "name": "should_allow_image_src_attribute",
     "input": "<img src='foo' onclick='bar' />",
-    "output": "<img src='foo'/>",
+    "output": "<img src='foo'/>"
   },
 
   {
     "name": "should_allow_image_width_attribute",
     "input": "<img width='foo' onclick='bar' />",
-    "output": "<img width='foo'/>",
+    "output": "<img width='foo'/>"
   },
 
   {
@@ -182,7 +182,7 @@
   {
     "name": "should_handle_malformed_image_tags",
     "input": "<img \"\"\"><script>alert(\"XSS\")</script>\">",
-    "output": "<img/>&lt;script&gt;alert(\"XSS\")&lt;/script&gt;\"&gt;",
+    "output": "<img/>&lt;script&gt;alert(\"XSS\")&lt;/script&gt;\"&gt;"
   },
 
   {
@@ -194,133 +194,133 @@
   {
     "name": "should_not_fall_for_ridiculous_hack",
     "input": "<img\nsrc\n=\n\"\nj\na\nv\na\ns\nc\nr\ni\np\nt\n:\na\nl\ne\nr\nt\n(\n'\nX\nS\nS\n'\n)\n\"\n />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_0",
     "input": "<img src=\"javascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_1",
     "input": "<img src=javascript:alert('XSS') />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_10",
     "input": "<img src=\"jav&#x0A;ascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_11",
     "input": "<img src=\"jav&#x0D;ascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_12",
     "input": "<img src=\" &#14;  javascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_13",
     "input": "<img src=\"&#x20;javascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_14",
     "input": "<img src=\"&#xA0;javascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_2",
     "input": "<img src=\"JaVaScRiPt:alert('XSS')\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_3",
     "input": "<img src='javascript:alert(&quot;XSS&quot;)' />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_4",
     "input": "<img src='javascript:alert(String.fromCharCode(88,83,83))' />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_5",
     "input": "<img src='&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;' />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_6",
     "input": "<img src='&#0000106;&#0000097;&#0000118;&#0000097;&#0000115;&#0000099;&#0000114;&#0000105;&#0000112;&#0000116;&#0000058;&#0000097;&#0000108;&#0000101;&#0000114;&#0000116;&#0000040;&#0000039;&#0000088;&#0000083;&#0000083;&#0000039;&#0000041' />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_7",
     "input": "<img src='&#x6A;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3A;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29' />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_8",
     "input": "<img src=\"jav\tascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_not_fall_for_xss_image_hack_9",
     "input": "<img src=\"jav&#x09;ascript:alert('XSS');\" />",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_sanitize_half_open_scripts",
     "input": "<img src=\"javascript:alert('XSS')\"",
-    "output": "<img/>",
+    "output": "<img/>"
   },
 
   {
     "name": "should_sanitize_invalid_script_tag",
     "input": "<script/XSS SRC=\"http://ha.ckers.org/xss.js\"></script>",
-    "output": "&lt;script XSS=\"\" SRC=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;",
+    "output": "&lt;script XSS=\"\" SRC=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;"
   },
 
   {
     "name": "should_sanitize_script_tag_with_multiple_open_brackets",
     "input": "<<script>alert(\"XSS\");//<</script>",
-    "output": "&lt;&lt;script&gt;alert(\"XSS\");//&lt;&lt;/script&gt;",
+    "output": "&lt;&lt;script&gt;alert(\"XSS\");//&lt;&lt;/script&gt;"
   },
 
   {
     "name": "should_sanitize_script_tag_with_multiple_open_brackets_2",
     "input": "<iframe src=http://ha.ckers.org/scriptlet.html\n<",
-    "output": "&lt;iframe src=\"http://ha.ckers.org/scriptlet.html\" &lt;=\"\"&gt;",
+    "output": "&lt;iframe src=\"http://ha.ckers.org/scriptlet.html\" &lt;=\"\"&gt;"
   },
 
   {
     "name": "should_sanitize_tag_broken_up_by_null",
     "input": "<scr\u0000ipt>alert(\"XSS\")</scr\u0000ipt>",
-    "output": "&lt;scr\ufffdipt&gt;alert(\"XSS\")&lt;/scr\ufffdipt&gt;",
+    "output": "&lt;scr\ufffdipt&gt;alert(\"XSS\")&lt;/scr\ufffdipt&gt;"
   },
 
   {
     "name": "should_sanitize_unclosed_script",
     "input": "<script src=http://ha.ckers.org/xss.js?<b>",
-    "output": "&lt;script src=\"http://ha.ckers.org/xss.js?&amp;lt;b\"&gt;",
+    "output": "&lt;script src=\"http://ha.ckers.org/xss.js?&amp;lt;b\"&gt;"
   },
 
   {
@@ -338,13 +338,13 @@
   {
     "name": "should_strip_src_attribute_in_img_with_bad_protocols",
     "input": "<img src=\"javascript:XSS\" title=\"1\">boo</img>",
-    "output": "<img title='1'/>boo",
+    "output": "<img title='1'/>boo"
   },
 
   {
     "name": "should_strip_src_attribute_in_img_with_bad_protocols_and_whitespace",
     "input": "<img src=\" javascript:XSS\" title=\"1\">boo</img>",
-    "output": "<img title='1'/>boo",
+    "output": "<img title='1'/>boo"
   },
 
   {
@@ -398,36 +398,36 @@
   {
     "name": "style_attr_end_with_nothing",
     "input": "<div style=\"color: blue\" />",
-    "output": "<div style='color: blue;'/>",
+    "output": "<div style='color: blue;'/>"
   },
 
   {
     "name": "style_attr_end_with_space",
     "input": "<div style=\"color: blue \" />",
-    "output": "<div style='color: blue ;'/>",
+    "output": "<div style='color: blue ;'/>"
   },
 
   {
     "name": "style_attr_end_with_semicolon",
     "input": "<div style=\"color: blue;\" />",
-    "output": "<div style='color: blue;'/>",
+    "output": "<div style='color: blue;'/>"
   },
 
   {
     "name": "style_attr_end_with_semicolon_space",
     "input": "<div style=\"color: blue; \" />",
-    "output": "<div style='color: blue;'/>",
+    "output": "<div style='color: blue;'/>"
   },
 
   {
    "name": "attributes_with_embedded_quotes",
    "input": "<img src=doesntexist.jpg\"'onerror=\"alert(1) />",
-   "output": "<img src='doesntexist.jpg&quot;&apos;onerror=&quot;alert(1)'/>",
+   "output": "<img src='doesntexist.jpg&quot;&apos;onerror=&quot;alert(1)'/>"
   },
 
   {
    "name": "attributes_with_embedded_quotes_II",
    "input": "<img src=notthere.jpg\"\"onerror=\"alert(2) />",
-   "output": "<img src='notthere.jpg&quot;&quot;onerror=&quot;alert(2)'/>",
+   "output": "<img src='notthere.jpg&quot;&quot;onerror=&quot;alert(2)'/>"
   }
 ]