wikimedia/mediawiki-extensions-Math
1
0
Fork 0
mirror of https://gerrit.wikimedia.org/r/mediawiki/extensions/Math synced 2024-11-15 11:48:23 +00:00
Code Issues Packages Projects Releases Wiki Activity
mediawiki-extensions-Math/tests/phpunit/MathInputCheckTest.php

23 lines
544 B
PHP
Raw Normal View History

Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c
2014-01-03 14:29:03 +00:00
<?php
Add more complete PHPDoc tags to all tests ... and remove some actual copy-paste mistakes. Change-Id: Id2fd83edff774a7f07b0f5436cefe2bf5c0a63f0
2016-02-12 16:57:37 +00:00
Move checking code to a new namespace Introduce new namespace \MediaWiki\Extension\Math\ and move checking code to this new namespace. Note, this commit is the first step of Ifd89e2d9cb30fa15cc318f077b434207ed6b7214 Bug: T252390, T187154 Change-Id: I8c93f4b21d4a72ef2d52d4774d69e4ef55d037ec
2020-05-12 16:41:04 +00:00
use MediaWiki\Extension\Math\InputCheck\BaseChecker;
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c
2014-01-03 14:29:03 +00:00
/**
Move checking code to a new namespace Introduce new namespace \MediaWiki\Extension\Math\ and move checking code to this new namespace. Note, this commit is the first step of Ifd89e2d9cb30fa15cc318f077b434207ed6b7214 Bug: T252390, T187154 Change-Id: I8c93f4b21d4a72ef2d52d4774d69e4ef55d037ec
2020-05-12 16:41:04 +00:00
* @covers \MediaWiki\Extension\Math\InputCheck\BaseChecker
Add more complete PHPDoc tags to all tests ... and remove some actual copy-paste mistakes. Change-Id: Id2fd83edff774a7f07b0f5436cefe2bf5c0a63f0
2016-02-12 16:57:37 +00:00
*
@group Math where it's missing Change-Id: If8ec86c4b70d7d78d30cab6f9529af1cd0c2ea52
2014-07-24 00:12:14 +00:00
* @group Math
Add more complete PHPDoc tags to all tests ... and remove some actual copy-paste mistakes. Change-Id: Id2fd83edff774a7f07b0f5436cefe2bf5c0a63f0
2016-02-12 16:57:37 +00:00
*
Use "@license GPL-2.0-or-later" according to SPDX Change-Id: I5b9ba062f51dce9fcc10f7c31f37c137176bfff3
2018-04-13 14:06:39 +00:00
* @license GPL-2.0-or-later
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c
2014-01-03 14:29:03 +00:00
*/
MediaWikiTestCase -> MediaWikiIntegrationTestCase MediaWikiTestCase has been renamed to MediaWikiIntegrationTestCase in 1.34. Bug: T293043 Change-Id: Icef9bbb1c515b775ccdcf6bc692c8c2cab4ae503
2021-10-11 22:51:10 +00:00
class MathInputCheckTest extends MediaWikiIntegrationTestCase {
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c
2014-01-03 14:29:03 +00:00
Always call original constructors in tests, and more cleanups * Get rid of a few more MockBuilders and mocks that aren't needed. * Make sure the original constructor is always called. This is highly relevant for I263a711. * Fix mixed order in assertions. In PHP, the expected value comes first. * Add some missing inline @var type hints. Change-Id: Ia15d62af56dfdb61bc2514aa994ce3d4ecd6e077
2019-11-26 11:01:30 +00:00
public function testAbstractClass() {
Move checking code to a new namespace Introduce new namespace \MediaWiki\Extension\Math\ and move checking code to this new namespace. Note, this commit is the first step of Ifd89e2d9cb30fa15cc318f077b434207ed6b7214 Bug: T252390, T187154 Change-Id: I8c93f4b21d4a72ef2d52d4774d69e4ef55d037ec
2020-05-12 16:41:04 +00:00
$InputCheck = $this->getMockForAbstractClass( BaseChecker::class );
/** @var BaseChecker $InputCheck */
Always call original constructors in tests, and more cleanups * Get rid of a few more MockBuilders and mocks that aren't needed. * Make sure the original constructor is always called. This is highly relevant for I263a711. * Fix mixed order in assertions. In PHP, the expected value comes first. * Add some missing inline @var type hints. Change-Id: Ia15d62af56dfdb61bc2514aa994ce3d4ecd6e077
2019-11-26 11:01:30 +00:00
$this->assertFalse( $InputCheck->IsValid() );
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c
2014-01-03 14:29:03 +00:00
$this->assertNull( $InputCheck->getError() );
$this->assertNull( $InputCheck->getValidTex() );
}
Always call original constructors in tests, and more cleanups * Get rid of a few more MockBuilders and mocks that aren't needed. * Make sure the original constructor is always called. This is highly relevant for I263a711. * Fix mixed order in assertions. In PHP, the expected value comes first. * Add some missing inline @var type hints. Change-Id: Ia15d62af56dfdb61bc2514aa994ce3d4ecd6e077
2019-11-26 11:01:30 +00:00
Validate TeX input for all renderers, not just texvc The user input specified in the math tag a. la <math>E=m <script>alert('attacked')</script>^2 </math> is verified in PNG rendering mode, but not in plaintext, MathJax or LaTeXML rendering mode. This is a potential security issue. Furthermore, the texvc specific commands such as $\reals$ that is expanded to $\mathbb{R}$ might be rendered differently depended on the rendering mode. Therefore, the security checking and rewriting portion of texvc have been extracted from the texvc source (see I1650e6ec2ccefff6335fbc36bbe8ca8f59db0faa) and are now available as a separate executable (texvccheck). This commit will now enable this enhancement in security and provide even more compatibility among the different rendering modes. Bug: 49169 Change-Id: Ida24b6bf339508753bed40d2e218c4a5b7fe7d0c
2014-01-03 14:29:03 +00:00
}
Reference in a new issue Copy permalink