Skip to content

Commit f6e7443

Browse files
committed
Add regression test
1 parent 4efa10c commit f6e7443

1 file changed

Lines changed: 15 additions & 0 deletions

File tree

tests/unit/Extension/DisallowedRawHtml/DisallowedRawHtmlRendererTest.php

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,16 @@ public static function dataProviderForTestWithDefaultSettings(): iterable
7171
yield ['<script>', '&lt;script>'];
7272
yield ['<plaintext>', '&lt;plaintext>'];
7373

74+
// Newline/whitespace bypass attempts (security fix)
75+
yield ["<script >", "&lt;script >"];
76+
yield ["<script\n>", "&lt;script\n>"];
77+
yield ["<script\t>", "&lt;script\t>"];
78+
yield ["<script\r\n>", "&lt;script\r\n>"];
79+
yield ["<iframe\nwidth=\"560\">", "&lt;iframe\nwidth=\"560\">"];
80+
81+
// Ensure non-disallowed tags with similar names are NOT filtered
82+
yield ['<scriptfoo>', '<scriptfoo>'];
83+
7484
// Tags not escaped by default
7585
yield ['<strong>', '<strong>'];
7686
}
@@ -107,6 +117,11 @@ public static function dataProviderForTestWithCustomSettings(): iterable
107117
yield ['<strong/>', '&lt;strong/>'];
108118
yield ['<strong />', '&lt;strong />'];
109119

120+
// Newline bypass with custom config
121+
yield ["<strong >", "&lt;strong >"];
122+
yield ["<strong\n>", "&lt;strong\n>"];
123+
yield ["<strong\t>", "&lt;strong\t>"];
124+
110125
// Defaults that I didn't include in my custom config
111126
yield ['<title>', '<title>'];
112127
yield ['<textarea>', '<textarea>'];

0 commit comments

Comments
 (0)