From 2ad0405643842c2bba42c23be6036173d0810a6d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 17:05:35 +0000
Subject: [PATCH] test: add XSS bypass bug-pin tests for StringUtils.sanitize()
 (Issue #8)

8 new bug-pin tests documenting the known XSS bypass vectors in sanitize().
Each test asserts the current broken behaviour so future changes surface
if a bypass is accidentally removed while others remain.

Bypass vectors pinned:
- <img src=x onerror=...>  (event handler on img tag)
- <svg onload=...>          (event handler on svg tag)
- <SCRIPT>...</SCRIPT>      (all-uppercase not stripped)
- <sCrIpT>...</sCrIpT>      (mixed-case not stripped)
- <script >...</script>     (space before > on opening tag)
- javascript: protocol in href/src
- <body onload=...>         (event handler on body)
- <iframe src="javascript:...">  (iframe not stripped)

No production code changed. No new dependencies.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../com/taskflow/util/StringUtilsTest.java    | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)
diff --git a/src/test/java/com/taskflow/util/StringUtilsTest.java b/src/test/java/com/taskflow/util/StringUtilsTest.java
index 32788ba..f73204e 100644
--- a/src/test/java/com/taskflow/util/StringUtilsTest.java
+++ b/src/test/java/com/taskflow/util/StringUtilsTest.java
@@ -91,4 +91,78 @@ public void testJoin() {
     }
     
     // No test for padRight - it has a known StringIndexOutOfBoundsException bug
+
+    // -------------------------------------------------------------------------
+    // BUG-PIN TESTS: sanitize() XSS bypass vectors (Issue #8)
+    //
+    // These tests document the *current broken behaviour* so that future changes
+    // will surface if any bypass is accidentally "fixed" while others remain,
+    // and so that a real fix must change ALL of them to assert the cleaned output.
+    //
+    // The sanitize() method only strips literal "<script>" / "</script>" (plus the
+    // Title-case variants).  Every other XSS vector passes through unchanged.
+    // -------------------------------------------------------------------------
+
+    @Test
+    public void testSanitize_imgOnerrorBypass() {
+        // BUG-PIN (Issue #8): <img onerror=...> is not removed — XSS bypass
+        String payload = "<img src=x onerror=alert(1)>";
+        assertEquals(payload, StringUtils.sanitize(payload),
+            "BUG: <img onerror=...> must be stripped but currently passes through unchanged");
+    }
+
+    @Test
+    public void testSanitize_svgOnloadBypass() {
+        // BUG-PIN (Issue #8): <svg onload=...> is not removed — XSS bypass
+        String payload = "<svg onload=alert(1)>";
+        assertEquals(payload, StringUtils.sanitize(payload),
+            "BUG: <svg onload=...> must be stripped but currently passes through unchanged");
+    }
+
+    @Test
+    public void testSanitize_uppercaseScriptNotStripped() {
+        // BUG-PIN (Issue #8): <SCRIPT> (all-caps) is not handled — XSS bypass
+        // Current behaviour: passes through unchanged (neither tag stripped)
+        assertEquals("<SCRIPT>alert(1)</SCRIPT>", StringUtils.sanitize("<SCRIPT>alert(1)</SCRIPT>"),
+            "BUG: all-uppercase <SCRIPT> tag is not stripped");
+    }
+
+    @Test
+    public void testSanitize_mixedCaseScriptNotStripped() {
+        // BUG-PIN (Issue #8): <sCrIpT> mixed-case variant is not handled — XSS bypass
+        assertEquals("<sCrIpT>alert(1)</sCrIpT>", StringUtils.sanitize("<sCrIpT>alert(1)</sCrIpT>"),
+            "BUG: mixed-case <script> tag is not stripped");
+    }
+
+    @Test
+    public void testSanitize_scriptWithSpaceNotStripped() {
+        // BUG-PIN (Issue #8): <script > (trailing space before >) is not handled — XSS bypass
+        // Current behaviour: closing </script> is stripped but opening <script > passes through
+        assertEquals("<script >alert(1)", StringUtils.sanitize("<script >alert(1)</script>"),
+            "BUG: <script > with trailing space is not stripped");
+    }
+
+    @Test
+    public void testSanitize_javascriptProtocolBypass() {
+        // BUG-PIN (Issue #8): javascript: protocol in href is not filtered — XSS bypass
+        String payload = "<a href=\"javascript:alert(1)\">click</a>";
+        assertEquals(payload, StringUtils.sanitize(payload),
+            "BUG: javascript: protocol is not stripped");
+    }
+
+    @Test
+    public void testSanitize_bodyOnloadBypass() {
+        // BUG-PIN (Issue #8): <body onload=...> event handler is not removed — XSS bypass
+        String payload = "<body onload=alert(1)>";
+        assertEquals(payload, StringUtils.sanitize(payload),
+            "BUG: <body onload=...> must be stripped but currently passes through unchanged");
+    }
+
+    @Test
+    public void testSanitize_iframeBypass() {
+        // BUG-PIN (Issue #8): <iframe src=javascript:...> is not removed — XSS bypass
+        String payload = "<iframe src=\"javascript:alert(1)\"></iframe>";
+        assertEquals(payload, StringUtils.sanitize(payload),
+            "BUG: <iframe> tag is not stripped");
+    }
 }
