add test cases for sanitization hardening

test/specs/run-spec.js

@@ -16,6 +16,8 @@ function runSpecs(title, dir, showCompletionTable, options) {
           spec.options = Object.assign({}, options, (spec.options || {}));
           const example = (spec.example ? ' example ' + spec.example : '');
           const passFail = (spec.shouldFail ? 'fail' : 'pass');
+          if (spec.options.sanitizerRemoveHtml)
+            spec.options.sanitizer = () => '';
           (spec.only ? fit : it)('should ' + passFail + example, () => {
             const before = process.hrtime();
             if (spec.shouldFail) {
@@ -40,3 +42,4 @@ runSpecs('CommonMark', './commonmark', true, { headerIds: false });
 runSpecs('Original', './original', false, { gfm: false });
 runSpecs('New', './new');
 runSpecs('ReDOS', './redos');
+runSpecs('Security', './security', false, { silent: true /* no deprecation warnings */ });

test/specs/security/sanitizer_bypass.html

@@ -0,0 +1,6 @@
+<p>AAA&lt;script&gt; &lt;img &lt;script&gt; src=x onerror=alert(1) /&gt;BBB</p>
+
+<p>AAA&lt;sometag&gt; &lt;img &lt;sometag&gt; src=x onerror=alert(1)BBB</p>
+
+<p>&lt;a&gt;a2&lt;a2t&gt;a2&lt;/a&gt; b &lt;c&gt;c&lt;/c&gt; d</p>
+<h1 id="text"><img src="URL" alt="text"></h1>

test/specs/security/sanitizer_bypass.md

@@ -0,0 +1,9 @@
+---
+sanitize: true
+---
+AAA<script> <img <script> src=x onerror=alert(1) />BBB
+
+AAA<sometag> <img <sometag> src=x onerror=alert(1)BBB
+
+<a>a2<a2t>a2</a> b <c>c</c> d
+# ![text](URL)

test/specs/security/sanitizer_bypass_remove_generic.html

@@ -0,0 +1,2 @@
+<p>a2a2 b c d</p>
+<h1 id="text"><img src="URL" alt="text"></h1>

test/specs/security/sanitizer_bypass_remove_generic.md

@@ -0,0 +1,6 @@
+---
+sanitize: true
+sanitizerRemoveHtml: true
+---
+<a>a2<a2t>a2</a> b <c>c</c> d
+# ![text](URL)

test/specs/security/sanitizer_bypass_remove_script.html

@@ -0,0 +1 @@
+<p>AAA</p>

test/specs/security/sanitizer_bypass_remove_script.md

@@ -0,0 +1,5 @@
+---
+sanitize: true
+sanitizerRemoveHtml: true
+---
+AAA<script> <img <script> src=x onerror=alert(1) />BBB

test/specs/security/sanitizer_bypass_remove_tag.html

@@ -0,0 +1 @@
+<p>AAA &lt;img  src=x onerror=alert(1)BBB</p>

test/specs/security/sanitizer_bypass_remove_tag.md

@@ -0,0 +1,5 @@
+---
+sanitize: true
+sanitizerRemoveHtml: true
+---
+AAA<sometag> <img <sometag> src=x onerror=alert(1)BBB