link', 'link', 'link', 'link', 'link', ] as $html) { $clean = raijuSanitizeRichHtml($html); securityAssert(str_contains($clean, 'href="#"'), 'Unsafe link survived: ' . $clean); } $clean = raijuSanitizeRichHtml('

Äpfelx

'); securityAssert(!preg_match('/onclick|onload|script|svg|alert\(/i', $clean), 'Active markup survived'); securityAssert(str_contains($clean, 'Äpfel'), 'Safe formatting lost'); $clean = raijuSanitizeRichHtml('link

Text

'); securityAssert(str_contains($clean, 'noopener noreferrer'), 'External link lacks safe relationship'); securityAssert(str_contains($clean, 'text-align: center') && !str_contains($clean, 'position'), 'Text style handling failed'); $_SERVER['HTTP_HOST'] = 'localhost:3000'; securityAssert(raijuSessionRedirectUrl('http://localhost:3000/services/test#part') === '/services/test#part', 'Same-origin redirect lost'); securityAssert(raijuSessionRedirectUrl('/services/test?x=1') === '/services/test?x=1', 'Relative redirect lost'); foreach (['javascript:alert(1)', '//other.invalid/', '/\\other.invalid/', '/admin', '/a/../admin/', 'http://localhost:4000/'] as $url) { securityAssert(raijuSessionRedirectUrl($url) === '/', 'Unsafe redirect accepted: ' . $url); } // Stored link targets (editableLink, gallery, event cards): dangerous schemes → "#". foreach (['javascript:alert(1)', 'JaVaScRiPt:x', "java\tscript:alert(1)", 'java script:x', 'data:text/html,x', 'vbscript:msgbox(1)', 'file:///etc/passwd'] as $url) { securityAssert(raijuSanitizeHref($url) === '#', 'Unsafe href survived: ' . $url); } foreach (['https://example.com/?a=1&b=2', '/relative/path', '#anchor', 'about', 'mailto:a@b.c', 'tel:+43123'] as $url) { securityAssert(raijuSanitizeHref($url) === $url, 'Safe href altered: ' . $url); } // Uploaded SVG sanitiser: active content removed, structure kept, DTD refused. $svgPath = tempnam(sys_get_temp_dir(), 'raiju-svg-') . '.svg'; try { $writeSvg = function (string $svg) use ($svgPath): string { file_put_contents($svgPath, $svg); $ok = raijuSanitizeSvgFile($svgPath); return $ok ? (string)file_get_contents($svgPath) : "\0REJECTED"; }; $cleaned = $writeSvg('' . '' . 'x'); securityAssert($cleaned !== "\0REJECTED", 'Valid SVG was rejected'); securityAssert(!preg_match('/]>' . '&x;') === "\0REJECTED", 'SVG with inline DTD was accepted'); securityAssert($writeSvg('not an svg at all') === "\0REJECTED", 'Non-SVG upload was accepted as SVG'); } finally { @unlink($svgPath); } echo "Security smoke test passed.\n";