Simplifying SafeString a bit: From a XSS HTML security point of view, treat clean() and purify() the same.

No longer run a safe HTML string through the HTML purifier (since it's already marked as safe).

This also addresses the issue of calling purify() when no purifier is installed. In that case, we'd run clean() on a clean string (double HTML encoding).

If this approach doesn't work out, we can still modify the fallback code of purify() to check if the string is already clean before calling clean() instead of purify().

1 files changed, 6 insertions, 0 deletions

diff --git a/modules/gallery/tests/SafeString_Test.php b/modules/gallery/tests/SafeString_Test.php
index fdab5c58..2c07d934 100644
--- a/modules/gallery/tests/SafeString_Test.php
+++ b/modules/gallery/tests/SafeString_Test.php
@@ -106,6 +106,12 @@ class SafeString_Test extends Unit_Test_Case {
     $this->assert_equal($expected, $safe_string_2);
   }
 
+  public function purify_safe_html_test() {
+    $safe_string = SafeString::of_safe_html("hello <p  >world</p>");
+    $actual = SafeString::purify($safe_string);
+    $this->assert_equal("hello <p  >world</p>", $actual);
+  }
+
   public function of_fluid_api_test() {
     $escaped_string = SafeString::of("Foo's bar")->for_js();
     $this->assert_equal('"Foo\'s bar"', $escaped_string);