test: add tests for internal escaping util functions

This commit adds extra tests for underlying escaping util functions to verify various scenarios and make it easy to add new scenarios.

lib/NodeUtils.js

@@ -10,7 +10,14 @@ module.exports = {
   // `NodeUtils.serializeOne` to get to the function and reduce pressure
   // on the megamorphic stub cache.
   // See https://github.com/fgnass/domino/pull/142 for more information.
-  serializeOne: serializeOne
+  serializeOne: serializeOne,
+
+  // Export util functions so that we can run extra test for them.
+  // Note: we prefix function names with `ɵ`, similar to what we do
+  // with internal functions in Angular packages.
+  ɵescapeMatchingClosingTag: escapeMatchingClosingTag,
+  ɵescapeClosingCommentTag: escapeClosingCommentTag,
+  ɵescapeProcessingInstructionContent: escapeProcessingInstructionContent
 };
 
 var utils = require('./utils');

test/xss.js

@@ -1,6 +1,7 @@
 'use strict';
 var domino = require('../lib');
 var puppeteer = require("puppeteer");
+var NodeUtils = require('../lib/NodeUtils');
 
 exports = exports.xss = {};
 
@@ -144,8 +145,7 @@ exports.styleMatchingClosingTagInRawText = function() {
   return alertFired(html).should.eventually.be.false('alert fired for: ' + html);
 };
 
-exports.styleMatchingClosingTagSkipsCommentedContent = function() {
-
+exports.styleMatchingClosingTagSkipsInsideCommentedContent = function() {
   const document = domino.createDocument('');
   const style = document.createElement("style");
   style.textContent = "abc<!--</style>--><script>alert(1)</script>";
@@ -303,3 +303,59 @@ exports.badProcessingInstruction = function() {
   const html = document.serialize();
   return alertFired(html).should.eventually.be.false('alert fired for: ' + html);
 }
+
+exports.verifyEscapeMatchingClosingTag = function() {
+  const cases = [
+    ['', 'style', ''], // no artifacts while processing an empty string
+    ['abc', 'script', 'abc'], // no artifacts while processing a string without closing tags
+    ['</style  /foobar>abc', 'style', '&lt;/style  /foobar>abc'],
+    ['</xmp><script>alert(1)</script>', 'xmp', '&lt;/xmp><script>alert(1)</script>'],
+    ['"</xmp>"', 'xmp', '"&lt;/xmp>"'],
+
+    // Raw content element inside another raw content element.
+    ['<xmp></style><script>alert(1)</script></xmp>', 'style',
+      '<xmp>&lt;/style><script>alert(1)</script></xmp>'],
+
+    ['abc</script><script>alert(1)&lt;/script>', 'script',
+      'abc&lt;/script><script>alert(1)&lt;/script>'],
+
+    // No changes to the content in case there are no matching closing tags.
+    ['<xmp></style><script>alert(1)</script></xmp>', 'iframe',
+      '<xmp></style><script>alert(1)</script></xmp>'],
+  ];
+  for (const [rawContent, parentTag, expected] of cases) {
+    NodeUtils.ɵescapeMatchingClosingTag(rawContent, parentTag).should.equal(expected);
+  }
+}
+
+exports.verifyEscapeClosingCommentTag = function() {
+  const cases = [
+    ['', ''], // no artifacts while processing an empty string
+    ['abc', 'abc'], // no artifacts while processing a string without closing tags
+    ['a-->bc-->', 'a--&gt;bc--&gt;'],
+    ['a--!>bc--!>', 'a--!&gt;bc--!&gt;'],
+    ['a- -> b c - ->', 'a- -> b c - ->'],
+    ['a- -!> b c - -!>', 'a- -!> b c - -!>'],
+    ['<!--a--!> <!--b--!>', '<!--a--!&gt; <!--b--!&gt;'],
+    ['<!--a--> <!--b-->', '<!--a--&gt; <!--b--&gt;'],
+    ['<!--a--&lt; <!--b--&lt;', '<!--a--&lt; <!--b--&lt;'],
+  ];
+  for (const [rawContent, expected] of cases) {
+    NodeUtils.ɵescapeClosingCommentTag(rawContent).should.equal(expected);
+  }
+}
+
+exports.verifyProcessingInstructionContent = function() {
+  const cases = [
+    ['', ''], // no artifacts while processing an empty string
+    ['abc', 'abc'], // no artifacts while processing a string without `>` chars
+    ['>>>', '&gt;&gt;&gt;'],
+    ['<<<', '<<<'],
+    ['><script>alert(1)</script>', '&gt;<script&gt;alert(1)</script&gt;'],
+    ['<!--a-->', '<!--a--&gt;'],
+    ['">"', '"&gt;"'],
+  ];
+  for (const [rawContent, expected] of cases) {
+    NodeUtils.ɵescapeProcessingInstructionContent(rawContent).should.equal(expected);
+  }
+}