mediawiki-extensions-Math/tests/phpunit/MathInputCheckTest.php

<?php

use MediaWiki\Extension\Math\InputCheck\BaseChecker;

/**
 * @covers \MediaWiki\Extension\Math\InputCheck\BaseChecker
 *
 * @group Math
 *
 * @license GPL-2.0-or-later
 */
class MathInputCheckTest extends MediaWikiTestCase {

	public function testAbstractClass() {
		$InputCheck = $this->getMockForAbstractClass( BaseChecker::class );
		/** @var BaseChecker $InputCheck */
		$this->assertFalse( $InputCheck->IsValid() );
		$this->assertNull( $InputCheck->getError() );
		$this->assertNull( $InputCheck->getValidTex() );
	}

}
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c 2014-01-03 14:29:03 +00:00			`<?php`
Add more complete PHPDoc tags to all tests ... and remove some actual copy-paste mistakes. Change-Id: Id2fd83edff774a7f07b0f5436cefe2bf5c0a63f0 2016-02-12 16:57:37 +00:00
Move checking code to a new namespace Introduce new namespace \MediaWiki\Extension\Math\ and move checking code to this new namespace. Note, this commit is the first step of Ifd89e2d9cb30fa15cc318f077b434207ed6b7214 Bug: T252390, T187154 Change-Id: I8c93f4b21d4a72ef2d52d4774d69e4ef55d037ec 2020-05-12 16:41:04 +00:00			`use MediaWiki\Extension\Math\InputCheck\BaseChecker;`

Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c 2014-01-03 14:29:03 +00:00			`/**`
Move checking code to a new namespace Introduce new namespace \MediaWiki\Extension\Math\ and move checking code to this new namespace. Note, this commit is the first step of Ifd89e2d9cb30fa15cc318f077b434207ed6b7214 Bug: T252390, T187154 Change-Id: I8c93f4b21d4a72ef2d52d4774d69e4ef55d037ec 2020-05-12 16:41:04 +00:00			`* @covers \MediaWiki\Extension\Math\InputCheck\BaseChecker`
Add more complete PHPDoc tags to all tests ... and remove some actual copy-paste mistakes. Change-Id: Id2fd83edff774a7f07b0f5436cefe2bf5c0a63f0 2016-02-12 16:57:37 +00:00			`*`
@group Math where it's missing Change-Id: If8ec86c4b70d7d78d30cab6f9529af1cd0c2ea52 2014-07-24 00:12:14 +00:00			`* @group Math`
Add more complete PHPDoc tags to all tests ... and remove some actual copy-paste mistakes. Change-Id: Id2fd83edff774a7f07b0f5436cefe2bf5c0a63f0 2016-02-12 16:57:37 +00:00			`*`
Use "@license GPL-2.0-or-later" according to SPDX Change-Id: I5b9ba062f51dce9fcc10f7c31f37c137176bfff3 2018-04-13 14:06:39 +00:00			`* @license GPL-2.0-or-later`
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c 2014-01-03 14:29:03 +00:00			`*/`
build: Updating mediawiki/mediawiki-codesniffer to 0.9.0 The following sniffs are failing and were disabled: * MediaWiki.Commenting.FunctionComment.DuplicateReturn * MediaWiki.Commenting.FunctionComment.MissingParamComment * MediaWiki.Commenting.FunctionComment.MissingParamName * MediaWiki.Commenting.FunctionComment.MissingParamTag * MediaWiki.Commenting.FunctionComment.MissingReturn * MediaWiki.Commenting.FunctionComment.ParamNameNoMatch * MediaWiki.Commenting.FunctionComment.WrongStyle * MediaWiki.FunctionComment.Missing.Protected * MediaWiki.FunctionComment.Missing.Public * MediaWiki.WhiteSpace.SpaceBeforeSingleLineComment.NewLineComment Change-Id: I46c900a5652a6560d18be6cd67badc37ed7f8d97 2017-06-20 07:11:57 +00:00			`class MathInputCheckTest extends MediaWikiTestCase {`
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c 2014-01-03 14:29:03 +00:00
Always call original constructors in tests, and more cleanups * Get rid of a few more MockBuilders and mocks that aren't needed. * Make sure the original constructor is always called. This is highly relevant for I263a711. * Fix mixed order in assertions. In PHP, the expected value comes first. * Add some missing inline @var type hints. Change-Id: Ia15d62af56dfdb61bc2514aa994ce3d4ecd6e077 2019-11-26 11:01:30 +00:00			`public function testAbstractClass() {`
Move checking code to a new namespace Introduce new namespace \MediaWiki\Extension\Math\ and move checking code to this new namespace. Note, this commit is the first step of Ifd89e2d9cb30fa15cc318f077b434207ed6b7214 Bug: T252390, T187154 Change-Id: I8c93f4b21d4a72ef2d52d4774d69e4ef55d037ec 2020-05-12 16:41:04 +00:00			`$InputCheck = $this->getMockForAbstractClass( BaseChecker::class );`
			`/** @var BaseChecker $InputCheck */`
Always call original constructors in tests, and more cleanups * Get rid of a few more MockBuilders and mocks that aren't needed. * Make sure the original constructor is always called. This is highly relevant for I263a711. * Fix mixed order in assertions. In PHP, the expected value comes first. * Add some missing inline @var type hints. Change-Id: Ia15d62af56dfdb61bc2514aa994ce3d4ecd6e077 2019-11-26 11:01:30 +00:00			`$this->assertFalse( $InputCheck->IsValid() );`
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c 2014-01-03 14:29:03 +00:00			`$this->assertNull( $InputCheck->getError() );`
			`$this->assertNull( $InputCheck->getValidTex() );`
			`}`
Always call original constructors in tests, and more cleanups * Get rid of a few more MockBuilders and mocks that aren't needed. * Make sure the original constructor is always called. This is highly relevant for I263a711. * Fix mixed order in assertions. In PHP, the expected value comes first. * Add some missing inline @var type hints. Change-Id: Ia15d62af56dfdb61bc2514aa994ce3d4ecd6e077 2019-11-26 11:01:30 +00:00
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c 2014-01-03 14:29:03 +00:00			`}`