3 files changed, 135 insertions, 38 deletions

diff --git a/tests/Url/CleanupUrlTest.php b/tests/Url/CleanupUrlTest.php
index ba9a0437..1407d7d2 100644
--- a/tests/Url/CleanupUrlTest.php
+++ b/tests/Url/CleanupUrlTest.php
@@ -8,7 +8,13 @@ require_once 'application/Url.php';
 class CleanupUrlTest extends PHPUnit_Framework_TestCase
 {
     /**
-     * Clean empty UrlThanks for building nothing
+     * @var string reference URL
+     */
+    protected $ref = 'http://domain.tld:3000';
+
+
+    /**
+     * Clean empty URL
      */
     public function testCleanupUrlEmpty()
     {
@@ -16,59 +22,87 @@ class CleanupUrlTest extends PHPUnit_Framework_TestCase
     }
 
     /**
-     * Clean an already cleaned Url
+     * Clean an already cleaned URL
      */
     public function testCleanupUrlAlreadyClean()
     {
-        $ref = 'http://domain.tld:3000';
-        $this->assertEquals($ref, cleanup_url($ref));
-        $ref = $ref.'/path/to/dir/';
-        $this->assertEquals($ref, cleanup_url($ref));
+        $this->assertEquals($this->ref, cleanup_url($this->ref));
+        $this->ref2 = $this->ref.'/path/to/dir/';
+        $this->assertEquals($this->ref2, cleanup_url($this->ref2));
+    }
+
+    /**
+     * Clean URL fragments
+     */
+    public function testCleanupUrlFragment()
+    {
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'#tk.rss_all'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'#xtor=RSS-'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'#xtor=RSS-U3ht0tkc4b'));
+    }
+
+    /**
+     * Clean URL query - single annoying parameter
+     */
+    public function testCleanupUrlQuerySingle()
+    {
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?action_object_map=junk'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?action_ref_map=Cr4p!'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?action_type_map=g4R84g3'));
+
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?fb_stuff=v41u3'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?fb=71m3w4573'));
+
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?utm_campaign=zomg'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?utm_medium=numnum'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?utm_source=c0d3'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?utm_term=1n4l'));
+
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?xtor=some-url'));
+
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?campaign_name=junk'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?campaign_start=junk'));
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?campaign_item_index=junk'));
     }
 
     /**
-     * Clean Url needing cleaning
+     * Clean URL query - multiple annoying parameters
      */
-    public function testCleanupUrlNeedClean()
+    public function testCleanupUrlQueryMultiple()
     {
-        $ref = 'http://domain.tld:3000';
-        $this->assertEquals($ref, cleanup_url($ref.'#tk.rss_all'));
-        $this->assertEquals($ref, cleanup_url($ref.'#xtor=RSS-'));
-        $this->assertEquals($ref, cleanup_url($ref.'#xtor=RSS-U3ht0tkc4b'));
-        $this->assertEquals($ref, cleanup_url($ref.'?action_object_map=junk'));
-        $this->assertEquals($ref, cleanup_url($ref.'?action_ref_map=Cr4p!'));
-        $this->assertEquals($ref, cleanup_url($ref.'?action_type_map=g4R84g3'));
-
-        $this->assertEquals($ref, cleanup_url($ref.'?fb_stuff=v41u3'));
-        $this->assertEquals($ref, cleanup_url($ref.'?fb=71m3w4573'));
-
-        $this->assertEquals($ref, cleanup_url($ref.'?utm_campaign=zomg'));
-        $this->assertEquals($ref, cleanup_url($ref.'?utm_medium=numnum'));
-        $this->assertEquals($ref, cleanup_url($ref.'?utm_source=c0d3'));
-        $this->assertEquals($ref, cleanup_url($ref.'?utm_term=1n4l'));
-
-        $this->assertEquals($ref, cleanup_url($ref.'?xtor=some-url'));
-        $this->assertEquals($ref, cleanup_url($ref.'?xtor=some-url&fb=som3th1ng'));
-        $this->assertEquals($ref, cleanup_url(
-            $ref.'?fb=stuff&utm_campaign=zomg&utm_medium=numnum&utm_source=c0d3'
+        $this->assertEquals($this->ref, cleanup_url($this->ref.'?xtor=some-url&fb=som3th1ng'));
+
+        $this->assertEquals($this->ref, cleanup_url(
+            $this->ref.'?fb=stuff&utm_campaign=zomg&utm_medium=numnum&utm_source=c0d3'
         ));
-        $this->assertEquals($ref, cleanup_url(
-            $ref.'?xtor=some-url&fb=som3th1ng#tk.rss_all'
+
+        $this->assertEquals($this->ref, cleanup_url(
+            $this->ref.'?campaign_start=zomg&campaign_name=numnum'
+        ));
+    }
+
+    /**
+     * Clean URL query - multiple annoying parameters and fragment
+     */
+    public function testCleanupUrlQueryFragment()
+    {
+        $this->assertEquals($this->ref, cleanup_url(
+            $this->ref.'?xtor=some-url&fb=som3th1ng#tk.rss_all'
         ));
 
         // ditch annoying query params and fragment, keep useful params
         $this->assertEquals(
-            $ref.'?my=stuff&is=kept',
+            $this->ref.'?my=stuff&is=kept',
             cleanup_url(
-                $ref.'?fb=zomg&my=stuff&utm_medium=numnum&is=kept#tk.rss_all'
+                $this->ref.'?fb=zomg&my=stuff&utm_medium=numnum&is=kept#tk.rss_all'
             )
         );
 
         // ditch annoying query params, keep useful params and fragment
         $this->assertEquals(
-            $ref.'?my=stuff&is=kept#again',
+            $this->ref.'?my=stuff&is=kept#again',
             cleanup_url(
-                $ref.'?fb=zomg&my=stuff&utm_medium=numnum&is=kept#again'
+                $this->ref.'?fb=zomg&my=stuff&utm_medium=numnum&is=kept#again'
             )
         );
     }
diff --git a/tests/Url/UrlTest.php b/tests/Url/UrlTest.php
index 05862372..aa2f2234 100644
--- a/tests/Url/UrlTest.php
+++ b/tests/Url/UrlTest.php
@@ -157,7 +157,7 @@ class UrlTest extends PHPUnit_Framework_TestCase
     /**
      * Test add trailing slash.
      */
-    function testAddTrailingSlash()
+    public function testAddTrailingSlash()
     {
         $strOn = 'http://randomstr.com/test/';
         $strOff = 'http://randomstr.com/test';
@@ -168,7 +168,7 @@ class UrlTest extends PHPUnit_Framework_TestCase
     /**
      * Test valid HTTP url.
      */
-    function testUrlIsHttp()
+    public function testUrlIsHttp()
     {
         $url = new Url(self::$baseUrl);
         $this->assertTrue($url->isHttp());
@@ -177,7 +177,7 @@ class UrlTest extends PHPUnit_Framework_TestCase
     /**
      * Test non HTTP url.
      */
-    function testUrlIsNotHttp()
+    public function testUrlIsNotHttp()
     {
         $url = new Url('ftp://save.tld/mysave');
         $this->assertFalse($url->isHttp());
@@ -186,7 +186,7 @@ class UrlTest extends PHPUnit_Framework_TestCase
     /**
      * Test International Domain Name to ASCII conversion
      */
-    function testIdnToAscii()
+    public function testIdnToAscii()
     {
         $ind = 'http://www.académie-française.fr/';
         $expected = 'http://www.xn--acadmie-franaise-npb1a.fr/';
diff --git a/tests/Url/WhitelistProtocolsTest.php b/tests/Url/WhitelistProtocolsTest.php
new file mode 100644
index 00000000..a3156804
--- /dev/null
+++ b/tests/Url/WhitelistProtocolsTest.php
@@ -0,0 +1,63 @@
+<?php
+
+require_once 'application/Url.php';
+
+use Shaarli\Config\ConfigManager;
+
+/**
+ * Class WhitelistProtocolsTest
+ *
+ * Test whitelist_protocols() function of Url.
+ */
+class WhitelistProtocolsTest extends PHPUnit_Framework_TestCase
+{
+    /**
+     * Test whitelist_protocols() on a note (relative URL).
+     */
+    public function testWhitelistProtocolsRelative()
+    {
+        $whitelist = ['ftp', 'magnet'];
+        $url = '?12443564';
+        $this->assertEquals($url, whitelist_protocols($url, $whitelist));
+        $url = '/path.jpg';
+        $this->assertEquals($url, whitelist_protocols($url, $whitelist));
+    }
+
+    /**
+     * Test whitelist_protocols() on a note (relative URL).
+     */
+    public function testWhitelistProtocolMissing()
+    {
+        $whitelist = ['ftp', 'magnet'];
+        $url = 'test.tld/path/?query=value#hash';
+        $this->assertEquals('http://'. $url, whitelist_protocols($url, $whitelist));
+    }
+
+    /**
+     * Test whitelist_protocols() with allowed protocols.
+     */
+    public function testWhitelistAllowedProtocol()
+    {
+        $whitelist = ['ftp', 'magnet'];
+        $url = 'http://test.tld/path/?query=value#hash';
+        $this->assertEquals($url, whitelist_protocols($url, $whitelist));
+        $url = 'https://test.tld/path/?query=value#hash';
+        $this->assertEquals($url, whitelist_protocols($url, $whitelist));
+        $url = 'ftp://test.tld/path/?query=value#hash';
+        $this->assertEquals($url, whitelist_protocols($url, $whitelist));
+        $url = 'magnet:test.tld/path/?query=value#hash';
+        $this->assertEquals($url, whitelist_protocols($url, $whitelist));
+    }
+
+    /**
+     * Test whitelist_protocols() with allowed protocols.
+     */
+    public function testWhitelistDisallowedProtocol()
+    {
+        $whitelist = ['ftp', 'magnet'];
+        $url = 'javascript:alert("xss");';
+        $this->assertEquals('http://alert("xss");', whitelist_protocols($url, $whitelist));
+        $url = 'other://test.tld/path/?query=value#hash';
+        $this->assertEquals('http://test.tld/path/?query=value#hash', whitelist_protocols($url, $whitelist));
+    }
+}