|
1 // Tests whether characters above 0x7F decode to ASCII characters liable to |
|
2 // expose XSS vulnerabilities |
|
3 load('CharsetConversionTests.js'); |
|
4 |
|
5 function run_test() { |
|
6 var failures = false; |
|
7 var ccManager = Cc["@mozilla.org/charset-converter-manager;1"] |
|
8 .getService(Ci.nsICharsetConverterManager); |
|
9 var decodingConverter = CreateScriptableConverter(); |
|
10 |
|
11 var charsetList = ccManager.getDecoderList(); |
|
12 var counter = 0; |
|
13 while (charsetList.hasMore()) { |
|
14 ++counter; |
|
15 var charset = charsetList.getNext(); |
|
16 dump("testing " + counter + " " + charset + "\n"); |
|
17 |
|
18 try { |
|
19 decodingConverter.charset = charset; |
|
20 } catch(e) { |
|
21 dump("Warning: couldn't set decoder charset to " + charset + "\n"); |
|
22 continue; |
|
23 } |
|
24 for (var i = 0x80; i < 0x100; ++i) { |
|
25 var inString = String.fromCharCode(i); |
|
26 var outString; |
|
27 try { |
|
28 outString = decodingConverter.ConvertToUnicode(inString) + |
|
29 decodingConverter.Finish(); |
|
30 } catch(e) { |
|
31 outString = String.fromCharCode(0xFFFD); |
|
32 } |
|
33 for (var n = 0; n < outString.length; ++n) { |
|
34 var outChar = outString.charAt(n); |
|
35 if (outChar == '<' || outChar == '>' || outChar == '/') { |
|
36 dump(charset + " has a problem: " + escape(inString) + |
|
37 " decodes to '" + outString + "'\n"); |
|
38 failures = true; |
|
39 } |
|
40 } |
|
41 } |
|
42 } |
|
43 if (failures) { |
|
44 do_throw("test failed\n"); |
|
45 } |
|
46 } |