eduvia/workavia-mail-front
11
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

TF-3315 Fix TMail web could not display embedded table correctly

Browse Source
This commit is contained in:
dab246
2024-12-03 11:55:11 +07:00
committed by Dat H. Pham
parent 75f66f3758
commit 338262b4b5
2 changed files with 93 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/lib/presentation/utils/html_transformer/text/standardize_html_sanitizing_transformers.dart
+3
View File
@@ -20,6 +20,9 @@ class StandardizeHtmlSanitizingTransformers extends TextTransformer {
'style',
'body',
'section',
'google-sheets-html-origin',
'colgroup',
'col',
'nav',
'main',
'footer',
core/test/utils/standardize_html_sanitizing_transformers_test.dart
+90 -75
View File
@@ -6,67 +6,80 @@ void main() {
group('StandardizeHtmlSanitizingTransformers::test', () {
const transformer = StandardizeHtmlSanitizingTransformers();
const htmlEscape = HtmlEscape();
const listHTMLTags = [
'div',
'span',
'p',
'a',
'i',
'table',
'font',
'u',
'center',
'style',
'section',
'google-sheets-html-origin',
];
const listOnEventAttributes = [
'mousedown',
'mouseenter',
'mouseleave',
'mousemove',
'mouseover',
'mouseout',
'mouseup',
'load',
'unload',
'loadstart',
'loadeddata',
'loadedmetadata',
'playing',
'show',
'error',
'message',
'focus',
'focusin',
'focusout',
'keydown',
'keypress',
'keyup',
'input',
'ended',
'drag',
'drop',
'dragstart',
'dragover',
'dragleave',
'dragend',
'dragenter',
'beforeunload',
'beforeprint',
'afterprint',
'blur',
'click',
'change',
'contextmenu',
'cut',
'copy',
'dblclick',
'abort',
'durationchange',
'progress',
'resize',
'reset',
'scroll',
'seeked',
'select',
'submit',
'toggle',
'volumechange',
'touchstart',
'touchmove',
'touchend',
'touchcancel',
];
test('SHOULD remove all `on*` attributes tag', () {
const listOnEventAttributes = [
'mousedown',
'mouseenter',
'mouseleave',
'mousemove',
'mouseover',
'mouseout',
'mouseup',
'load',
'unload',
'loadstart',
'loadeddata',
'loadedmetadata',
'playing',
'show',
'error',
'message',
'focus',
'focusin',
'focusout',
'keydown',
'keydpress',
'keydup',
'input',
'ended',
'drag',
'drop',
'dragstart',
'dragover',
'dragleave',
'dragend',
'dragenter',
'beforeunload',
'beforeprint',
'afterprint',
'blur',
'click',
'change',
'contextmenu',
'cut',
'copy',
'dblclick',
'abort',
'durationchange',
'progress',
'resize',
'reset',
'scroll',
'seeked',
'select',
'submit',
'toggle',
'volumechange',
'touchstart',
'touchmove',
'touchend',
'touchcancel'
];
for (var i = 0; i < listOnEventAttributes.length; i++) {
final inputHtml = '<img src="1" href="1" on${listOnEventAttributes[i]}="javascript:alert(1)">';
final result = transformer.process(inputHtml, htmlEscape);
@@ -76,22 +89,6 @@ void main() {
});
test('SHOULD remove all `on*` attributes for any tags', () {
const listOnEventAttributes = [
'mousedown', 'mouseenter', 'mouseleave', 'mousemove', 'mouseover',
'mouseout', 'mouseup', 'load', 'unload', 'loadstart', 'loadeddata',
'loadedmetadata', 'playing', 'show', 'error', 'message', 'focus',
'focusin', 'focusout', 'keydown', 'keypress', 'keyup', 'input', 'ended',
'drag', 'drop', 'dragstart', 'dragover', 'dragleave', 'dragend', 'dragenter',
'beforeunload', 'beforeprint', 'afterprint', 'blur', 'click', 'change',
'contextmenu', 'cut', 'copy', 'dblclick', 'abort', 'durationchange',
'progress', 'resize', 'reset', 'scroll', 'seeked', 'select', 'submit',
'toggle', 'volumechange', 'touchstart', 'touchmove', 'touchend', 'touchcancel'
];
const listHTMLTags = [
'div', 'span', 'p', 'a', 'u', 'i', 'table', 'section'
];
for (var tag in listHTMLTags) {
for (var event in listOnEventAttributes) {
final inputHtml = '<$tag on$event="javascript:alert(1)"></$tag>';
@@ -102,6 +99,24 @@ void main() {
}
});
test('SHOULD remove all `on*` attributes for `colgroup` tag', () {
for (var event in listOnEventAttributes) {
final inputHtml = '<table><colgroup on$event="javascript:alert(1)"></colgroup></table>';
final result = transformer.process(inputHtml, htmlEscape);
expect(result, equals('<table><colgroup></colgroup></table>'));
}
});
test('SHOULD remove all `on*` attributes for `col` tag', () {
for (var event in listOnEventAttributes) {
final inputHtml = '<table><colgroup><col on$event="javascript:alert(1)"></colgroup></table>';
final result = transformer.process(inputHtml, htmlEscape);
expect(result, equals('<table><colgroup><col></colgroup></table>'));
}
});
test('SHOULD remove attributes of IMG tag WHEN they are invalid', () {
const inputHtml = '<img src="1" href="1" onerror="javascript:alert(1)">';
final result = transformer.process(inputHtml, htmlEscape);