diff --git a/SECURITY.md b/SECURITY.md index 04e8e51..c3d6974 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,8 +7,7 @@ The following matrix shows the versions that are currently maintained. | Version | Supported | |---------|--------------------| | 2.x | :white_check_mark: | -| 1.5.x | :white_check_mark: | -| < 1.5.0 | :x: | +| < 2.x | :x: | ## Reporting a Vulnerability diff --git a/tests/Behavior/AttrTest.php b/tests/Behavior/AttrTest.php index 3191028..fbefe93 100644 --- a/tests/Behavior/AttrTest.php +++ b/tests/Behavior/AttrTest.php @@ -78,17 +78,15 @@ public function withValuesClonesInstanceWhenModified(): void self::assertNotSame($attr, $attr->withValues($valueA, $valueD)); } - public static function matchesNameDataProvider(): array + public static function matchesNameDataProvider(): iterable { - return [ - [ Attr::BLUNT, 'name', 'name', true ], - [ Attr::BLUNT, 'name', 'other', false ], - [ Attr::BLUNT, 'name', 'name-other', false ], - [ Attr::NAME_PREFIX, 'name-', 'name-', true ], - [ Attr::NAME_PREFIX, 'name-', 'name-other', true ], - [ Attr::NAME_PREFIX, 'name-', 'name', false ], - [ Attr::NAME_PREFIX, 'name-', 'other', false ], - ]; + yield [ Attr::BLUNT, 'name', 'name', true ]; + yield [ Attr::BLUNT, 'name', 'other', false ]; + yield [ Attr::BLUNT, 'name', 'name-other', false ]; + yield [ Attr::NAME_PREFIX, 'name-', 'name-', true ]; + yield [ Attr::NAME_PREFIX, 'name-', 'name-other', true ]; + yield [ Attr::NAME_PREFIX, 'name-', 'name', false ]; + yield [ Attr::NAME_PREFIX, 'name-', 'other', false ]; } /** @@ -105,30 +103,28 @@ public function matchesName(int $flags, string $name, string $matchName, bool $e self::assertSame($expectation, $attr->matchesName($matchName)); } - public static function matchesValueDataProvider(): array + public static function matchesValueDataProvider(): iterable { $equalsA = new DatasetAttrValue('a'); $equalsB = new DatasetAttrValue('b'); $equalsAorB = new DatasetAttrValue('a', 'b'); - return [ - [ Attr::MATCH_ALL_VALUES, [$equalsA], 'a', true ], - [ Attr::MATCH_ALL_VALUES, [$equalsA], 'b', false ], - [ Attr::MATCH_ALL_VALUES, [$equalsAorB], 'a', true ], - [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsAorB], 'a', true ], - [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB], 'a', false ], // both `$equalsA` and `$equalsB` must match - [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB], 'b', false ], // both `$equalsA` and `$equalsB` must match - [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB], 'c', false ], - [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB, $equalsAorB], 'c', false ], - [ Attr::BLUNT, [$equalsA], 'a', true ], - [ Attr::BLUNT, [$equalsA], 'b', false ], - [ Attr::BLUNT, [$equalsAorB], 'a', true ], - [ Attr::BLUNT, [$equalsA, $equalsAorB], 'a', true ], - [ Attr::BLUNT, [$equalsA, $equalsB], 'a', true ], - [ Attr::BLUNT, [$equalsA, $equalsB], 'b', true ], - [ Attr::BLUNT, [$equalsA, $equalsB], 'c', false ], - [ Attr::BLUNT, [$equalsA, $equalsB, $equalsAorB], 'c', false ], - ]; + yield [ Attr::MATCH_ALL_VALUES, [$equalsA], 'a', true ]; + yield [ Attr::MATCH_ALL_VALUES, [$equalsA], 'b', false ]; + yield [ Attr::MATCH_ALL_VALUES, [$equalsAorB], 'a', true ]; + yield [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsAorB], 'a', true ]; + yield [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB], 'a', false ]; // both `$equalsA` and `$equalsB` must match + yield [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB], 'b', false ]; // both `$equalsA` and `$equalsB` must match + yield [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB], 'c', false ]; + yield [ Attr::MATCH_ALL_VALUES, [$equalsA, $equalsB, $equalsAorB], 'c', false ]; + yield [ Attr::BLUNT, [$equalsA], 'a', true ]; + yield [ Attr::BLUNT, [$equalsA], 'b', false ]; + yield [ Attr::BLUNT, [$equalsAorB], 'a', true ]; + yield [ Attr::BLUNT, [$equalsA, $equalsAorB], 'a', true ]; + yield [ Attr::BLUNT, [$equalsA, $equalsB], 'a', true ]; + yield [ Attr::BLUNT, [$equalsA, $equalsB], 'b', true ]; + yield [ Attr::BLUNT, [$equalsA, $equalsB], 'c', false ]; + yield [ Attr::BLUNT, [$equalsA, $equalsB, $equalsAorB], 'c', false ]; } /** diff --git a/tests/Behavior/TagTest.php b/tests/Behavior/TagTest.php index 44d5589..d2df8d2 100644 --- a/tests/Behavior/TagTest.php +++ b/tests/Behavior/TagTest.php @@ -21,15 +21,13 @@ class TagTest extends TestCase { - public function ambiguityIsDetectedDataProvider(): array + public static function ambiguityIsDetectedDataProvider(): iterable { - return [ - [ ['same'], ['same'], 1625394715 ], - [ ['same', 'same'], [], 1625590355 ], - [ ['same', 'same'], ['same'], 1625590355 ], - [ [], ['same', 'same'], 1625590355 ], - [ ['same'], ['same', 'same'], 1625590355 ], - ]; + yield [ ['same'], ['same'], 1625394715 ]; + yield [ ['same', 'same'], [], 1625590355 ]; + yield [ ['same', 'same'], ['same'], 1625590355 ]; + yield [ [], ['same', 'same'], 1625590355 ]; + yield [ ['same'], ['same', 'same'], 1625590355 ]; } /** diff --git a/tests/BehaviorTest.php b/tests/BehaviorTest.php index 4575d14..323cc68 100644 --- a/tests/BehaviorTest.php +++ b/tests/BehaviorTest.php @@ -21,14 +21,12 @@ class BehaviorTest extends TestCase { - public function ambiguityIsDetectedDataProvider(): array + public static function ambiguityIsDetectedDataProvider(): iterable { - return [ - [ ['same', 'same'], [], 1625591503 ], - [ ['same', 'same'], ['same'], 1625591503 ], - [ [], ['same', 'same'], 1625591503 ], - [ ['same'], ['same', 'same'], 1625591503 ], - ]; + yield [ ['same', 'same'], [], 1625591503 ]; + yield [ ['same', 'same'], ['same'], 1625591503 ]; + yield [ [], ['same', 'same'], 1625591503 ]; + yield [ ['same'], ['same', 'same'], 1625591503 ]; } /** diff --git a/tests/CommonBuilderTest.php b/tests/CommonBuilderTest.php index 2e2da3e..5ce6fc5 100644 --- a/tests/CommonBuilderTest.php +++ b/tests/CommonBuilderTest.php @@ -19,302 +19,300 @@ class CommonBuilderTest extends TestCase { - public function isSanitizedDataProvider(): array + public static function isSanitizedDataProvider(): iterable { - return [ - '#010' => [ + yield '#010' => [ + 'value', + '<unknown unknown="unknown">value</unknown>', + ]; + yield '#011' => [ + '
value
', + '
<unknown unknown="unknown">value</unknown>
', + ]; + yield '#012' => [ + '<script>alert(1)</script>', + '<script>alert(1)</script>', + ]; + yield '#013' => [ + 'value' . 'value', - '<unknown unknown="unknown">value</unknown>', - ], - '#011' => [ - '
value
', - '
<unknown unknown="unknown">value</unknown>
', - ], - '#012' => [ - '<script>alert(1)</script>', - '<script>alert(1)</script>', - ], - '#013' => [ - 'value' . - 'value', - '<unknown unknown="unknown">value</unknown>' . - '<unknown unknown="unknown">value</unknown>' - ], - '#014' => [ - 'valuevalue' . - '
value
' . - 'valuevalue', - '<unknown>value</unknown><unknown>value</unknown>' . - '
value
' . - '<unknown>value</unknown><unknown>value</unknown>' - ], - '#015' => [ - '
value
', - // '<unknown unknown="unknown" class="nested">
value
</unknown>', - // @todo invalidating nested nodes due invalid parent node is currently expected - topic for discussion - '<unknown unknown="unknown" class="nested"><div class="nested">value</div></unknown>', - ], - // @todo bug in https://github.com/Masterminds/html5-php/issues - // '#013' => [ - // 'Given that x < y and y > z...', - // 'Given that x < y and y > z...', - // ], - '#020' => [ - '
value
', - '
value
', - ], - '#030' => [ - '
value
', - '
value
', - ], - '#031' => [ - '
value
', - '
value
', - ], - '#032' => [ - '
value
', - '
value
', - ], - '#040' => [ - '', - '', - ], - '#041' => [ - '', - '', - ], - '#042' => [ - '', - '', - ], - '#043' => [ - '', - '', - ], - '#044' => [ - '', - '', - ], - '#045' => [ - '', - '', - ], - '#046' => [ - 'logo', - 'logo', - ], - '#047' => [ - '', - '', - ], - '#048' => [ - '', - '', - ], - '#049' => [ - 'GitHub', - 'GitHub', - ], - '#050' => [ - 'value', - 'value', - ], - '#051' => [ - 'value', - 'value', - ], - '#052' => [ - 'value', - 'value', - ], - '#053' => [ - 'value', - 'value', - ], - '#054' => [ - 'anchorcontent', - 'anchorcontent', - ], - '#055' => [ - 'anchor', - 'anchor', - ], - '#090' => [ - '

value

', - '

value

' - ], - '#100' => [ - '
c
h
b
f
', - '
c
h
b
f
', - ], - '#101' => [ - '
', - '
', - ], - '#102' => [ - 'caption', - 'caption', - ], - '#104' => [ - 'td', - 'td', - ], - '#105' => [ - 'value', - 'value', - ], - '#106' => [ - 'td', - 'td', - ], - '#107' => [ - 'td', - 'td', - ], - '#108' => [ - 'td', - 'td', - ], - '#109' => [ - '', - '', - ], - '#120' => [ - '
logo
TYPO3 logo
', - '
logo
TYPO3 logo
', - ], - '#121' => [ - '', - '' - ], - '#122' => [ - '', - '', - ], - '200' => [ - '', - '', - ], - '201' => [ - '
  1. item
  2. item
', - '
  1. item
  2. item
', - ], - '#900' => [ - '
' . - 'TYPO3
' . - '(the tag shall be encoded to HTML entities)'. - '
', - '
' . - 'TYPO3
' . - '(the <script>alert(1)</script> tag shall be encoded to HTML entities)'. - '
', - ], - '#901' => [ - '
' . - '+1-234-56789' . - '' . - '
', - '
' . - '+1-234-56789' . - '' . - '
' - ], - '#902' => [ - '
', - '
' - ], - '#903' => [ - 'value', - 'value' - ], - '#904' => [ - '', - '', - ], - '#905' => [ - 'see previous message', - 'see previous message', - ], - '#906' => [ - '
value
valuevalue', - '
value
valuevalue', - ], - '#907' => [ - '' - . '' - . '', - '<script>alert(1)</script>' - . '<script type="application/javascript">alert(2)</script>' - . '<script type="application/ecmascript">alert(3)</script>' - ], - '#908' => [ - 'value', - 'value', - ], - '#909' => [ - '', - '', - ], - '#910' => [ - '', - '', - ], - '#911' => [ - '', - '', - ], - '#912' => [ - '

', - '', - ], - '#913' => [ - '', - ], - '#915' => [ - '#text', - '#text', - ], - '#920' => [ - '', - '#cdata', - ], - '#921' => [ - '*/]]>', - '<any><span data-value="value"></any>*/', - ], - '#930' => [ - '
value
', - '
<any>value</any>
', - ], - '#931' => [ - '


value', - '
<any>value</any>', - ], - '#932' => [ - 'value', - '<any>value</any>', - ], - '#933' => [ - 'value', - '<any>value</any>', - ], - '#934' => [ - 'value', - '<any>value</any>', - ], - '#935' => [ - '

value

', - '

value

', - ], - '#936' => [ - '

value

', - '

value

', - ], - '#941' => [ - 's ?>', - '<?xml >s<img src=x onerror=alert(1)> ?>', - ], + '<unknown unknown="unknown">value</unknown>' . + '<unknown unknown="unknown">value</unknown>' + ]; + yield '#014' => [ + 'valuevalue' . + '
value
' . + 'valuevalue', + '<unknown>value</unknown><unknown>value</unknown>' . + '
value
' . + '<unknown>value</unknown><unknown>value</unknown>' + ]; + yield '#015' => [ + '
value
', + // '<unknown unknown="unknown" class="nested">
value
</unknown>', + // @todo invalidating nested nodes due invalid parent node is currently expected - topic for discussion + '<unknown unknown="unknown" class="nested"><div class="nested">value</div></unknown>', + ]; + // @todo bug in https://github.com/Masterminds/html5-php/issues + // '#013' => [ + // 'Given that x < y and y > z...', + // 'Given that x < y and y > z...', + // ], + yield '#020' => [ + '
value
', + '
value
', + ]; + yield '#030' => [ + '
value
', + '
value
', + ]; + yield '#031' => [ + '
value
', + '
value
', + ]; + yield '#032' => [ + '
value
', + '
value
', + ]; + yield '#040' => [ + '', + '', + ]; + yield '#041' => [ + '', + '', + ]; + yield '#042' => [ + '', + '', + ]; + yield '#043' => [ + '', + '', + ]; + yield '#044' => [ + '', + '', + ]; + yield '#045' => [ + '', + '', + ]; + yield '#046' => [ + 'logo', + 'logo', + ]; + yield '#047' => [ + '', + '', + ]; + yield '#048' => [ + '', + '', + ]; + yield '#049' => [ + 'GitHub', + 'GitHub', + ]; + yield '#050' => [ + 'value', + 'value', + ]; + yield '#051' => [ + 'value', + 'value', + ]; + yield '#052' => [ + 'value', + 'value', + ]; + yield '#053' => [ + 'value', + 'value', + ]; + yield '#054' => [ + 'anchorcontent', + 'anchorcontent', + ]; + yield '#055' => [ + 'anchor', + 'anchor', + ]; + yield '#090' => [ + '

value

', + '

value

' + ]; + yield '#100' => [ + '
c
h
b
f
', + '
c
h
b
f
', + ]; + yield '#101' => [ + '
', + '
', + ]; + yield '#102' => [ + 'caption', + 'caption', + ]; + yield '#104' => [ + 'td', + 'td', + ]; + yield '#105' => [ + 'value', + 'value', + ]; + yield '#106' => [ + 'td', + 'td', + ]; + yield '#107' => [ + 'td', + 'td', + ]; + yield '#108' => [ + 'td', + 'td', + ]; + yield '#109' => [ + '', + '', + ]; + yield '#120' => [ + '
logo
TYPO3 logo
', + '
logo
TYPO3 logo
', + ]; + yield '#121' => [ + '', + '' + ]; + yield '#122' => [ + '', + '', + ]; + yield '200' => [ + '', + '', + ]; + yield '201' => [ + '
  1. item
  2. item
', + '
  1. item
  2. item
', + ]; + yield '#900' => [ + '
' . + 'TYPO3
' . + '(the tag shall be encoded to HTML entities)'. + '
', + '
' . + 'TYPO3
' . + '(the <script>alert(1)</script> tag shall be encoded to HTML entities)'. + '
', + ]; + yield '#901' => [ + '
' . + '+1-234-56789' . + '' . + '
', + '
' . + '+1-234-56789' . + '' . + '
' + ]; + yield '#902' => [ + '
', + '
' + ]; + yield '#903' => [ + 'value', + 'value' + ]; + yield '#904' => [ + '', + '', + ]; + yield '#905' => [ + 'see previous message', + 'see previous message', + ]; + yield '#906' => [ + '
value
valuevalue', + '
value
valuevalue', + ]; + yield '#907' => [ + '' + . '' + . '', + '<script>alert(1)</script>' + . '<script type="application/javascript">alert(2)</script>' + . '<script type="application/ecmascript">alert(3)</script>' + ]; + yield '#908' => [ + 'value', + 'value', + ]; + yield '#909' => [ + '', + '', + ]; + yield '#910' => [ + '', + '', + ]; + yield '#911' => [ + '', + '', + ]; + yield '#912' => [ + '

', + '', + ]; + yield '#913' => [ + '', + ]; + yield '#915' => [ + '#text', + '#text', + ]; + yield '#920' => [ + '', + '#cdata', + ]; + yield '#921' => [ + '*/]]>', + '<any><span data-value="value"></any>*/', + ]; + yield '#930' => [ + '
value
', + '
<any>value</any>
', + ]; + yield '#931' => [ + '


value', + '
<any>value</any>', + ]; + yield '#932' => [ + 'value', + '<any>value</any>', + ]; + yield '#933' => [ + 'value', + '<any>value</any>', + ]; + yield '#934' => [ + 'value', + '<any>value</any>', + ]; + yield '#935' => [ + '

value

', + '

value

', + ]; + yield '#936' => [ + '

value

', + '

value

', + ]; + yield '#941' => [ + 's ?>', + '<?xml >s<img src=x onerror=alert(1)> ?>', ]; } diff --git a/tests/ScenarioTest.php b/tests/ScenarioTest.php index 1f86b57..dee6047 100644 --- a/tests/ScenarioTest.php +++ b/tests/ScenarioTest.php @@ -26,13 +26,11 @@ class ScenarioTest extends TestCase { - public static function allTagsAreRemovedOnMissingDeclarationDataProvider(): array + public static function allTagsAreRemovedOnMissingDeclarationDataProvider(): iterable { - return [ - ['
value
value', ''], - ['
value
', ''], - ['
value
', ''], - ]; + yield ['
value
value', '']; + yield ['
value
', '']; + yield ['
value
', '']; } /** @@ -49,56 +47,54 @@ public function allTagsAreRemovedOnMissingDeclaration(string $payload, string $e self::assertSame($expectation, $sanitizer->sanitize($payload)); } - public static function tagFlagsAreProcessedDataProvider(): array + public static function tagFlagsAreProcessedDataProvider(): iterable { - return [ - [ - Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::PURGE_WITHOUT_CHILDREN, - implode("\n", [ - '
', - '
test
test
', - '
', - '
', - '
', - ]), - implode("\n", [ - '', - '
test
test
', - '
', - '
', - '
', - ]), - ], - [ - Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::PURGE_WITHOUT_CHILDREN, - implode("\n", [ - '', - '', - '', - '', - ]), - implode("\n", [ - '', - '', - '', - '', - ]), - ], - [ - Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::PURGE_WITHOUT_CHILDREN | Behavior\Tag::ALLOW_INSECURE_RAW_TEXT, - implode("\n", [ - '', - '', - '', - '', - ]), - implode("\n", [ - '', - '', - '', - '', - ]), - ], + yield [ + Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::PURGE_WITHOUT_CHILDREN, + implode("\n", [ + '
', + '
test
test
', + '
', + '
', + '
', + ]), + implode("\n", [ + '', + '
test
test
', + '
', + '
', + '
', + ]), + ]; + yield [ + Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::PURGE_WITHOUT_CHILDREN, + implode("\n", [ + '', + '', + '', + '', + ]), + implode("\n", [ + '', + '', + '', + '', + ]), + ]; + yield [ + Behavior\Tag::ALLOW_CHILDREN | Behavior\Tag::PURGE_WITHOUT_CHILDREN | Behavior\Tag::ALLOW_INSECURE_RAW_TEXT, + implode("\n", [ + '', + '', + '', + '', + ]), + implode("\n", [ + '', + '', + '', + '', + ]), ]; } @@ -109,7 +105,7 @@ public static function tagFlagsAreProcessedDataProvider(): array public function tagFlagsAreProcessed(int $flags, string $payload, string $expectation): void { $behavior = (new Behavior()) - ->withFlags(Behavior::ENCODE_INVALID_TAG | Behavior::REMOVE_UNEXPECTED_CHILDREN) + ->withFlags(Behavior::REMOVE_UNEXPECTED_CHILDREN) ->withName('scenario-test') ->withTags( (new Behavior\Tag('i')), // just used as DOM child element @@ -124,7 +120,7 @@ public function tagFlagsAreProcessed(int $flags, string $payload, string $expect self::assertSame($expectation, $sanitizer->sanitize($payload)); } - public static function tagIsHandledDataProcessor(): array + public static function tagIsHandledDataProcessor(): iterable { $node = new Behavior\Tag('div'); $asTextHandler = new Behavior\Handler\AsTextHandler(); @@ -137,59 +133,57 @@ static function (NodeInterface $node, ?DOMNode $domNode): ?\DOMNode { } ); - return [ - [ - new Behavior\NodeHandler( - $node, - $asTextHandler - ), - '
unexpected
', - '<div invalid-attr="value"><i>unexpected</i></div>', - ], - [ - new Behavior\NodeHandler( - $node, - $asTextHandler, - Behavior\NodeHandler::PROCESS_DEFAULTS - ), - '
unexpected
', - '<div></div>', - ], - [ - new Behavior\NodeHandler( - $node, - $asTextHandler, - Behavior\NodeHandler::PROCESS_DEFAULTS | Behavior\NodeHandler::HANDLE_FIRST - ), - '
unexpected
', - '<div invalid-attr="value"><i>unexpected</i></div>', - ], - [ - new Behavior\NodeHandler( - $node, - $closureHandler - ), - '
unexpected
', - 'Handled <div>', - ], - [ - new Behavior\NodeHandler( - $node, - $closureHandler, - Behavior\NodeHandler::PROCESS_DEFAULTS - ), - '
unexpected
', - 'Handled <div>', - ], - [ - new Behavior\NodeHandler( - $node, - $closureHandler, - Behavior\NodeHandler::PROCESS_DEFAULTS | Behavior\NodeHandler::HANDLE_FIRST - ), - '
unexpected
', - 'Handled <div>', - ], + yield [ + new Behavior\NodeHandler( + $node, + $asTextHandler + ), + '
unexpected
', + '<div invalid-attr="value"><i>unexpected</i></div>', + ]; + yield [ + new Behavior\NodeHandler( + $node, + $asTextHandler, + Behavior\NodeHandler::PROCESS_DEFAULTS + ), + '
unexpected
', + '<div></div>', + ]; + yield [ + new Behavior\NodeHandler( + $node, + $asTextHandler, + Behavior\NodeHandler::PROCESS_DEFAULTS | Behavior\NodeHandler::HANDLE_FIRST + ), + '
unexpected
', + '<div invalid-attr="value"><i>unexpected</i></div>', + ]; + yield [ + new Behavior\NodeHandler( + $node, + $closureHandler + ), + '
unexpected
', + 'Handled <div>', + ]; + yield [ + new Behavior\NodeHandler( + $node, + $closureHandler, + Behavior\NodeHandler::PROCESS_DEFAULTS + ), + '
unexpected
', + 'Handled <div>', + ]; + yield [ + new Behavior\NodeHandler( + $node, + $closureHandler, + Behavior\NodeHandler::PROCESS_DEFAULTS | Behavior\NodeHandler::HANDLE_FIRST + ), + '
unexpected
', + 'Handled <div>', ]; } @@ -246,51 +240,49 @@ static function (NodeInterface $node, ?DOMNode $domNode): ?\DOMNode { self::assertSame($expectation, $sanitizer->sanitize($payload)); } - public static function commentsAreHandledDataProvider(): array + public static function commentsAreHandledDataProvider(): iterable { - return [ - 'not allowed' => [ - false, - null, - Behavior::BLUNT, - '
test
', - '
test
' - ], - 'allowed, insecure' => [ - true, - false, - Behavior::BLUNT, - '
test
', - '
test
' - ], - 'allowed, secure' => [ - true, - true, - Behavior::BLUNT, - '
test
', - '
test
' - ], - 'not allowed, encode invalid' => [ - false, - null, - Behavior::ENCODE_INVALID_COMMENT, - '
test
', - '
<!-- before -->test<!-- after -->
', - ], - 'allowed, insecure, encode invalid' => [ - true, - false, - Behavior::ENCODE_INVALID_COMMENT, - '
test
', - '
test
' - ], - 'allowed, secure, encode invalid' => [ - true, - true, - Behavior::ENCODE_INVALID_COMMENT, - '
test
', - '
test
' - ], + yield 'not allowed' => [ + false, + null, + Behavior::BLUNT, + '
test
', + '
test
' + ]; + yield 'allowed, insecure' => [ + true, + false, + Behavior::BLUNT, + '
test
', + '
test
' + ]; + yield 'allowed, secure' => [ + true, + true, + Behavior::BLUNT, + '
test
', + '
test
' + ]; + yield 'not allowed, encode invalid' => [ + false, + null, + Behavior::ENCODE_INVALID_COMMENT, + '
test
', + '
<!-- before -->test<!-- after -->
', + ]; + yield 'allowed, insecure, encode invalid' => [ + true, + false, + Behavior::ENCODE_INVALID_COMMENT, + '
test
', + '
test
' + ]; + yield 'allowed, secure, encode invalid' => [ + true, + true, + Behavior::ENCODE_INVALID_COMMENT, + '
test
', + '
test
' ]; } @@ -313,51 +305,49 @@ public function commentsAreHandled(bool $allowed, ?bool $secure, int $flags, str self::assertSame($expectation, $sanitizer->sanitize($payload)); } - public static function cdataSectionsAreHandledDataProvider(): array + public static function cdataSectionsAreHandledDataProvider(): iterable { - return [ - 'not allowed' => [ - false, - null, - Behavior::BLUNT, - '
.test.
', - '
.test.
' - ], - 'allowed, insecure' => [ - true, - false, - Behavior::BLUNT, - '
.test.
', - '
.test.
' - ], - 'allowed, secure' => [ - true, - true, - Behavior::BLUNT, - '
.test.
', - '
before.test.after
' - ], - 'not allowed, encode invalid' => [ - false, - null, - Behavior::ENCODE_INVALID_CDATA_SECTION, - '
.test.
', - '
<![CDATA[ before ]]>.test.<![CDATA[ after ]]>
', - ], - 'allowed, insecure, encode invalid' => [ - true, - false, - Behavior::ENCODE_INVALID_CDATA_SECTION, - '
.test.
', - '
.test.
' - ], - 'allowed, secure, encode invalid' => [ - true, - true, - Behavior::ENCODE_INVALID_CDATA_SECTION, - '
.test.
', - '
before.test.after
' - ], + yield 'not allowed' => [ + false, + null, + Behavior::BLUNT, + '
.test.
', + '
.test.
' + ]; + yield 'allowed, insecure' => [ + true, + false, + Behavior::BLUNT, + '
.test.
', + '
.test.
' + ]; + yield 'allowed, secure' => [ + true, + true, + Behavior::BLUNT, + '
.test.
', + '
before.test.after
' + ]; + yield 'not allowed, encode invalid' => [ + false, + null, + Behavior::ENCODE_INVALID_CDATA_SECTION, + '
.test.
', + '
<![CDATA[ before ]]>.test.<![CDATA[ after ]]>
', + ]; + yield 'allowed, insecure, encode invalid' => [ + true, + false, + Behavior::ENCODE_INVALID_CDATA_SECTION, + '
.test.
', + '
.test.
' + ]; + yield 'allowed, secure, encode invalid' => [ + true, + true, + Behavior::ENCODE_INVALID_CDATA_SECTION, + '
.test.
', + '
before.test.after
' ]; } @@ -380,7 +370,7 @@ public function cdataSectionsAreHandled(bool $allowed, ?bool $secure, int $flags self::assertSame($expectation, $sanitizer->sanitize($payload)); } - public static function rawTextElementsAreHandledDataProvider(): \Generator + public static function rawTextElementsAreHandledDataProvider(): iterable { foreach (Elements::$html5 as $name => $flags) { if (($flags & Elements::TEXT_RAW) !== Elements::TEXT_RAW) { @@ -539,7 +529,7 @@ public function iframeSandboxIsAllowed(): void self::assertSame($expectation, $sanitizer->sanitize($payload)); } - public static function attributesAreEncodedDataProvider(): \Generator + public static function attributesAreEncodedDataProvider(): iterable { yield 'preserve entities' => [ '', @@ -605,7 +595,7 @@ public static function attributesAreEncodedDataProvider(): \Generator public function attributesAreEncoded(string $payload, string $expectation): void { $behavior = (new Behavior()) - ->withFlags(Behavior::ENCODE_INVALID_TAG | Behavior::REMOVE_UNEXPECTED_CHILDREN) + ->withFlags(Behavior::REMOVE_UNEXPECTED_CHILDREN) ->withName('scenario-test') ->withTags( (new Behavior\Tag('a', Behavior\Tag::ALLOW_CHILDREN))->addAttrs( @@ -624,7 +614,7 @@ public function attributesAreEncoded(string $payload, string $expectation): void self::assertSame($expectation, $sanitizer->sanitize($payload)); } - public static function specialTagsAreHandledDataProvider(): \Generator + public static function specialTagsAreHandledDataProvider(): iterable { yield 'noscript attribute' => [ '