This class is adapted from code coming from Zend Framework. More...

Inheritance diagram for Twig_Test_EscapingTest:

Collaboration diagram for Twig_Test_EscapingTest:

Public Member Functions
	testHtmlEscapingConvertsSpecialChars ()

	testHtmlAttributeEscapingConvertsSpecialChars ()

	testJavascriptEscapingConvertsSpecialChars ()

	testJavascriptEscapingReturnsStringIfZeroLength ()

	testJavascriptEscapingReturnsStringIfContainsOnlyDigits ()

	testCssEscapingConvertsSpecialChars ()

	testCssEscapingReturnsStringIfZeroLength ()

	testCssEscapingReturnsStringIfContainsOnlyDigits ()

	testUrlEscapingConvertsSpecialChars ()

	testUnicodeCodepointConversionToUtf8 ()
	Range tests to confirm escaped range of characters is within OWASP recommendation. More...

	testJavascriptEscapingEscapesOwaspRecommendedRanges ()

	testHtmlAttributeEscapingEscapesOwaspRecommendedRanges ()

	testCssEscapingEscapesOwaspRecommendedRanges ()

Protected Member Functions
	setUp ()

	codepointToUtf8 ($codepoint)
	Convert a Unicode Codepoint to a literal UTF-8 character. More...

Protected Attributes
	$htmlSpecialChars
	All character encodings supported by htmlspecialchars(). More...

	$htmlAttrSpecialChars

	$jsSpecialChars

	$urlSpecialChars

	$cssSpecialChars

	$env

Detailed Description

This class is adapted from code coming from Zend Framework.

Copyright: Copyright (c) 2005-2012 Zend Technologies USA Inc. (http://www.zend.com) http://framework.zend.com/license/new-bsd New BSD License

Definition at line 9 of file escapingTest.php.

Member Function Documentation

◆ codepointToUtf8()

Twig_Test_EscapingTest::codepointToUtf8 ( $codepoint )

protected

Convert a Unicode Codepoint to a literal UTF-8 character.

Parameters

int $codepoint Unicode codepoint in hex notation

Returns: string UTF-8 literal string

Definition at line 233 of file escapingTest.php.

Referenced by testCssEscapingEscapesOwaspRecommendedRanges(), testHtmlAttributeEscapingEscapesOwaspRecommendedRanges(), testJavascriptEscapingEscapesOwaspRecommendedRanges(), and testUnicodeCodepointConversionToUtf8().

     {
         if ($codepoint < 0x80) {
             return chr($codepoint);
         }
         if ($codepoint < 0x800) {
             return chr($codepoint >> 6 & 0x3f | 0xc0)
                 .chr($codepoint & 0x3f | 0x80);
         }
         if ($codepoint < 0x10000) {
             return chr($codepoint >> 12 & 0x0f | 0xe0)
                 .chr($codepoint >> 6 & 0x3f | 0x80)
                 .chr($codepoint & 0x3f | 0x80);
         }
         if ($codepoint < 0x110000) {
             return chr($codepoint >> 18 & 0x07 | 0xf0)
                 .chr($codepoint >> 12 & 0x3f | 0x80)
                 .chr($codepoint >> 6 & 0x3f | 0x80)
                 .chr($codepoint & 0x3f | 0x80);
         }
         throw new Exception('Codepoint requested outside of Unicode range.');
     }

Here is the caller graph for this function:

◆ setUp()

Twig_Test_EscapingTest::setUp ( )

protected

Definition at line 147 of file escapingTest.php.

     {
         $this->env = new Twig_Environment($this->getMockBuilder('Twig_LoaderInterface')->getMock());
     }

◆ testCssEscapingConvertsSpecialChars()

Twig_Test_EscapingTest::testCssEscapingConvertsSpecialChars ( )

Definition at line 183 of file escapingTest.php.

References $key.

     {
         foreach ($this->cssSpecialChars as $key => $value) {
             $this->assertEquals($value, twig_escape_filter($this->env, $key, 'css'), 'Failed to escape: '.$key);
         }
     }

◆ testCssEscapingEscapesOwaspRecommendedRanges()

Twig_Test_EscapingTest::testCssEscapingEscapesOwaspRecommendedRanges ( )

Definition at line 302 of file escapingTest.php.

References codepointToUtf8().

     {
         // CSS has no exceptions to escaping ranges
         for ($chr = 0; $chr < 0xFF; ++$chr) {
             if ($chr >= 0x30 && $chr <= 0x39
             || $chr >= 0x41 && $chr <= 0x5A
             || $chr >= 0x61 && $chr <= 0x7A) {
                 $literal = $this->codepointToUtf8($chr);
                 $this->assertEquals($literal, twig_escape_filter($this->env, $literal, 'css'));
             } else {
                 $literal = $this->codepointToUtf8($chr);
                 $this->assertNotEquals(
                     $literal,
                     twig_escape_filter($this->env, $literal, 'css'),
                     "$literal should be escaped!");
             }
         }
     }

Here is the call graph for this function:

◆ testCssEscapingReturnsStringIfContainsOnlyDigits()

Twig_Test_EscapingTest::testCssEscapingReturnsStringIfContainsOnlyDigits ( )

Definition at line 195 of file escapingTest.php.

     {
         $this->assertEquals('123', twig_escape_filter($this->env, '123', 'css'));
     }

◆ testCssEscapingReturnsStringIfZeroLength()

Twig_Test_EscapingTest::testCssEscapingReturnsStringIfZeroLength ( )

Definition at line 190 of file escapingTest.php.

     {
         $this->assertEquals('', twig_escape_filter($this->env, '', 'css'));
     }

◆ testHtmlAttributeEscapingConvertsSpecialChars()

Twig_Test_EscapingTest::testHtmlAttributeEscapingConvertsSpecialChars ( )

Definition at line 159 of file escapingTest.php.

References $key.

     {
         foreach ($this->htmlAttrSpecialChars as $key => $value) {
             $this->assertEquals($value, twig_escape_filter($this->env, $key, 'html_attr'), 'Failed to escape: '.$key);
         }
     }

◆ testHtmlAttributeEscapingEscapesOwaspRecommendedRanges()

Twig_Test_EscapingTest::testHtmlAttributeEscapingEscapesOwaspRecommendedRanges ( )

Definition at line 279 of file escapingTest.php.

References codepointToUtf8().

     {
         $immune = array(',', '.', '-', '_'); // Exceptions to escaping ranges
         for ($chr = 0; $chr < 0xFF; ++$chr) {
             if ($chr >= 0x30 && $chr <= 0x39
             || $chr >= 0x41 && $chr <= 0x5A
             || $chr >= 0x61 && $chr <= 0x7A) {
                 $literal = $this->codepointToUtf8($chr);
                 $this->assertEquals($literal, twig_escape_filter($this->env, $literal, 'html_attr'));
             } else {
                 $literal = $this->codepointToUtf8($chr);
                 if (in_array($literal, $immune)) {
                     $this->assertEquals($literal, twig_escape_filter($this->env, $literal, 'html_attr'));
                 } else {
                     $this->assertNotEquals(
                         $literal,
                         twig_escape_filter($this->env, $literal, 'html_attr'),
                         "$literal should be escaped!");
                 }
             }
         }
     }

Here is the call graph for this function:

◆ testHtmlEscapingConvertsSpecialChars()

Twig_Test_EscapingTest::testHtmlEscapingConvertsSpecialChars ( )

Definition at line 152 of file escapingTest.php.

References $key.

     {
         foreach ($this->htmlSpecialChars as $key => $value) {
             $this->assertEquals($value, twig_escape_filter($this->env, $key, 'html'), 'Failed to escape: '.$key);
         }
     }

◆ testJavascriptEscapingConvertsSpecialChars()

Twig_Test_EscapingTest::testJavascriptEscapingConvertsSpecialChars ( )

Definition at line 166 of file escapingTest.php.

References $key.

     {
         foreach ($this->jsSpecialChars as $key => $value) {
             $this->assertEquals($value, twig_escape_filter($this->env, $key, 'js'), 'Failed to escape: '.$key);
         }
     }

◆ testJavascriptEscapingEscapesOwaspRecommendedRanges()

Twig_Test_EscapingTest::testJavascriptEscapingEscapesOwaspRecommendedRanges ( )

Definition at line 256 of file escapingTest.php.

References codepointToUtf8().

     {
         $immune = array(',', '.', '_'); // Exceptions to escaping ranges
         for ($chr = 0; $chr < 0xFF; ++$chr) {
             if ($chr >= 0x30 && $chr <= 0x39
             || $chr >= 0x41 && $chr <= 0x5A
             || $chr >= 0x61 && $chr <= 0x7A) {
                 $literal = $this->codepointToUtf8($chr);
                 $this->assertEquals($literal, twig_escape_filter($this->env, $literal, 'js'));
             } else {
                 $literal = $this->codepointToUtf8($chr);
                 if (in_array($literal, $immune)) {
                     $this->assertEquals($literal, twig_escape_filter($this->env, $literal, 'js'));
                 } else {
                     $this->assertNotEquals(
                         $literal,
                         twig_escape_filter($this->env, $literal, 'js'),
                         "$literal should be escaped!");
                 }
             }
         }
     }

Here is the call graph for this function:

◆ testJavascriptEscapingReturnsStringIfContainsOnlyDigits()

Twig_Test_EscapingTest::testJavascriptEscapingReturnsStringIfContainsOnlyDigits ( )

Definition at line 178 of file escapingTest.php.

     {
         $this->assertEquals('123', twig_escape_filter($this->env, '123', 'js'));
     }

◆ testJavascriptEscapingReturnsStringIfZeroLength()

Twig_Test_EscapingTest::testJavascriptEscapingReturnsStringIfZeroLength ( )

Definition at line 173 of file escapingTest.php.

     {
         $this->assertEquals('', twig_escape_filter($this->env, '', 'js'));
     }

◆ testUnicodeCodepointConversionToUtf8()

Twig_Test_EscapingTest::testUnicodeCodepointConversionToUtf8 ( )

Range tests to confirm escaped range of characters is within OWASP recommendation.

Only testing the first few 2 ranges on this prot. function as that's all these other range tests require.

Definition at line 215 of file escapingTest.php.

References $result, and codepointToUtf8().

     {
         $expected = ' ~ޙ';
         $codepoints = array(0x20, 0x7e, 0x799);
         $result = '';
         foreach ($codepoints as $value) {
             $result .= $this->codepointToUtf8($value);
         }
         $this->assertEquals($expected, $result);
     }

Here is the call graph for this function:

◆ testUrlEscapingConvertsSpecialChars()

Twig_Test_EscapingTest::testUrlEscapingConvertsSpecialChars ( )

Definition at line 200 of file escapingTest.php.

References $key.

     {
         foreach ($this->urlSpecialChars as $key => $value) {
             $this->assertEquals($value, twig_escape_filter($this->env, $key, 'url'), 'Failed to escape: '.$key);
         }
     }

Field Documentation

◆ $cssSpecialChars

Twig_Test_EscapingTest::$cssSpecialChars

protected

Initial value:

= array(
        
        '<' => '\\3C ',
        '>' => '\\3E ',
        '\'' => '\\27 ',
        '"' => '\\22 ',
        '&' => '\\26 ',
        
        'Ā' => '\\100 ',
        
        ',' => '\\2C ',
        '.' => '\\2E ',
        '_' => '\\5F ',
        
        'a' => 'a',
        'A' => 'A',
        'z' => 'z',
        'Z' => 'Z',
        '0' => '0',
        '9' => '9',
        
        "\r" => '\\D ',
        "\n" => '\\A ',
        "\t" => '\\9 ',
        "\0" => '\\0 ',
        
        ' ' => '\\20 ',
    )

Definition at line 116 of file escapingTest.php.

◆ $env

Twig_Test_EscapingTest::$env

protected

Definition at line 145 of file escapingTest.php.

◆ $htmlAttrSpecialChars

Twig_Test_EscapingTest::$htmlAttrSpecialChars

protected

Initial value:

= array(
        '\'' => '&#x27;',
        
        'Ā' => '&#x0100;',
        
        ',' => ',',
        '.' => '.',
        '-' => '-',
        '_' => '_',
        
        'a' => 'a',
        'A' => 'A',
        'z' => 'z',
        'Z' => 'Z',
        '0' => '0',
        '9' => '9',
        
        "\r" => '&#x0D;',
        "\n" => '&#x0A;',
        "\t" => '&#x09;',
        "\0" => '&#xFFFD;', 
        
        '<' => '&lt;',
        '>' => '&gt;',
        '&' => '&amp;',
        '"' => '&quot;',
        
        ' ' => '&#x20;',
    )

Definition at line 22 of file escapingTest.php.

◆ $htmlSpecialChars

Twig_Test_EscapingTest::$htmlSpecialChars

protected

Initial value:

= array(
        '\'' => '&#039;',
        '"' => '&quot;',
        '<' => '&lt;',
        '>' => '&gt;',
        '&' => '&amp;',
    )

All character encodings supported by htmlspecialchars().

Definition at line 14 of file escapingTest.php.

◆ $jsSpecialChars

Twig_Test_EscapingTest::$jsSpecialChars

protected

Initial value:

= array(
        
        '<' => '\\x3C',
        '>' => '\\x3E',
        '\'' => '\\x27',
        '"' => '\\x22',
        '&' => '\\x26',
        
        'Ā' => '\\u0100',
        
        ',' => ',',
        '.' => '.',
        '_' => '_',
        
        'a' => 'a',
        'A' => 'A',
        'z' => 'z',
        'Z' => 'Z',
        '0' => '0',
        '9' => '9',
        
        "\r" => '\\x0D',
        "\n" => '\\x0A',
        "\t" => '\\x09',
        "\0" => '\\x00',
        
        ' ' => '\\x20',
    )

Definition at line 52 of file escapingTest.php.

◆ $urlSpecialChars

Twig_Test_EscapingTest::$urlSpecialChars

protected

Definition at line 81 of file escapingTest.php.

The documentation for this class was generated from the following file:

libs/composer/vendor/twig/twig/test/Twig/Tests/escapingTest.php

Public Member Functions

Protected Member Functions

Protected Attributes

Detailed Description

Member Function Documentation

◆ codepointToUtf8()

◆ setUp()

◆ testCssEscapingConvertsSpecialChars()

◆ testCssEscapingEscapesOwaspRecommendedRanges()

◆ testCssEscapingReturnsStringIfContainsOnlyDigits()

◆ testCssEscapingReturnsStringIfZeroLength()

◆ testHtmlAttributeEscapingConvertsSpecialChars()

◆ testHtmlAttributeEscapingEscapesOwaspRecommendedRanges()

◆ testHtmlEscapingConvertsSpecialChars()

◆ testJavascriptEscapingConvertsSpecialChars()

◆ testJavascriptEscapingEscapesOwaspRecommendedRanges()

◆ testJavascriptEscapingReturnsStringIfContainsOnlyDigits()

◆ testJavascriptEscapingReturnsStringIfZeroLength()

◆ testUnicodeCodepointConversionToUtf8()

◆ testUrlEscapingConvertsSpecialChars()

Field Documentation

◆ $cssSpecialChars

◆ $env

◆ $htmlAttrSpecialChars

◆ $htmlSpecialChars

◆ $jsSpecialChars

◆ $urlSpecialChars