filter.test

<?php
/**
 * @file
 * Tests for filter.module.
 */

/**
 * Tests for text format and filter CRUD operations.
 */
class FilterCRUDTestCase extends BackdropWebTestCase {
  function setUp() {
    parent::setUp('filter_test');
  }

  /**
   * Tests CRUD operations for text formats and filters.
   */
  function testTextFormatCRUD() {
    // Add a text format with minimum data only.
    $format = new stdClass();
    $format->format = 'empty_format';
    $format->name = 'Empty format';
    filter_format_save($format);
    $this->verifyTextFormat($format);
    $this->verifyFilters($format);

    // Add another text format specifying all possible properties.
    $format = new stdClass();
    $format->format = 'custom_format';
    $format->name = 'Custom format';
    $format->filters = array(
      'filter_url' => array(
        'status' => 1,
        'settings' => array(
          'filter_url_length' => 30,
        ),
      ),
    );
    filter_format_save($format);
    $this->verifyTextFormat($format);
    $this->verifyFilters($format);

    // Alter some text format properties and save again.
    $format->name = 'Altered format';
    $format->filters['filter_url']->status = 0;
    $format->filters['filter_autop'] = (object) array(
      'status' => 1,
    );
    filter_format_save($format);
    $this->verifyTextFormat($format);
    $this->verifyFilters($format);

    // Add an uncacheable filter and save again.
    $format->filters['filter_test_uncacheable'] = (object) array(
      'status' => 1,
    );
    filter_format_save($format);
    $this->verifyTextFormat($format);
    $this->verifyFilters($format);

    // Disable the text format.
    filter_format_disable($format);

    $config_format = config_get('filter.format.' . $format->format);
    $this->assertFalse($config_format['status'], 'Disabled text format is marked as disabled in config.');
    $formats = filter_formats();
    $this->assertTrue(!isset($formats[$format->format]), 'filter_formats: Disabled text format no longer exists.');

    // Add a new format to check for XSS in format name.
    $format = new stdClass();
    $format->format = 'xss_format';
    $format->name = '<script>alert(123)</script>';
    filter_format_save($format);
    user_role_change_permissions(BACKDROP_ANONYMOUS_ROLE, array(filter_permission_name($format) => 1));
    $this->backdropGet('filter/tips');
    $this->assertNoRaw($format->name, 'Text format name contains no xss.');
  }

  /**
   * Verifies that a text format is properly stored.
   */
  function verifyTextFormat($format) {
    $t_args = array('%format' => $format->name);
    // Verify text format database record.
    $config_format = (object) config_get('filter.format.' . $format->format);
    $this->assertEqual($config_format->format, $format->format, format_string('Database: Proper format id for text format %format.', $t_args));
    $this->assertEqual($config_format->name, $format->name, format_string('Database: Proper title for text format %format.', $t_args));
    $this->assertEqual($config_format->cache, $format->cache, format_string('Database: Proper cache indicator for text format %format.', $t_args));
    $this->assertEqual($config_format->weight, $format->weight, format_string('Database: Proper weight for text format %format.', $t_args));

    // Verify filter_format_load().
    $filter_format = filter_format_load($format->format);
    $this->assertEqual($filter_format->format, $format->format, format_string('filter_format_load: Proper format id for text format %format.', $t_args));
    $this->assertEqual($filter_format->name, $format->name, format_string('filter_format_load: Proper title for text format %format.', $t_args));
    $this->assertEqual($filter_format->cache, $format->cache, format_string('filter_format_load: Proper cache indicator for text format %format.', $t_args));
    $this->assertEqual($filter_format->weight, $format->weight, format_string('filter_format_load: Proper weight for text format %format.', $t_args));

    // Verify the 'cache' text format property according to enabled filters.
    $filter_info = filter_get_filters();
    $cacheable = TRUE;
    foreach ($filter_format->filters as $name => $filter) {
      // If this filter is not cacheable, update $cacheable accordingly, so we
      // can verify $format->cache after iterating over all filters.
      if ($filter->status && isset($filter_info[$name]['cache']) && !$filter_info[$name]['cache']) {
        $cacheable = FALSE;
        break;
      }
    }
    $this->assertEqual($filter_format->cache, $cacheable, 'Text format contains proper cache property.');
  }

  /**
   * Verifies that filters are properly stored for a text format.
   */
  function verifyFilters($format) {
    // Verify filter database records.
    $config_filters = (object) config_get('filter.format.' . $format->format, 'filters');
    $format_filters = $format->filters;
    $all_filter_info = filter_get_filters();
    foreach ($config_filters as $name => $config_filter) {
      $config_filter = (object) $config_filter;
      $t_args = array('%format' => $format->name, '%filter' => $name);

      // Verify that filter status is properly stored.
      $this->assertEqual($config_filter->status, $format_filters[$name]->status, format_string('Proper status for %filter in text format %format in config.', $t_args));

      // Verify that filter settings were properly stored.
      $this->assertEqual($config_filter->settings, $format_filters[$name]->settings, format_string('Proper filter settings for %filter in text format %format in config.', $t_args));

      // Verify that each filter has a module name assigned.
      $this->assertEqual($config_filter->module, $all_filter_info[$name]['module'], format_string('Module name assigned for %filter in text format %format.', $t_args));

      // Remove the filter from the copy of saved $format to check whether all
      // filters have been processed later.
      unset($format_filters[$name]);
    }
    // Verify that all filters have been processed.
    $this->assertTrue(empty($format_filters), 'Config contains values for all filters in the saved format.');
  }
}

/**
 * Tests the administrative functionality of the Filter module.
 */
class FilterAdminTestCase extends BackdropWebTestCase {

  /**
   * @var User
   */
  protected $admin_user;

  /**
   * @var User
   */
  protected $web_user;

  function setUp() {
    parent::setUp();

    // Create users.
    $filtered_html_format = filter_format_load('filtered_html');
    $full_html_format = filter_format_load('full_html');
    $this->admin_user = $this->backdropCreateUser(array(
      'administer filters',
      filter_permission_name($filtered_html_format),
      filter_permission_name($full_html_format),
    ));

    $this->web_user = $this->backdropCreateUser(array('create page content', 'edit own page content'));
    $this->backdropLogin($this->admin_user);
  }

  /**
     * Click a link to perform an operation on a text format.
     *
     * In general, we expect lots of links titled "Enable" or "Disable" on the
     * text formats listing page, and the links might have tokens in them. So we
     * need special code to find the correct link to click.
     *
     * @param $label
     *   Text between the anchor tags of the desired link.
     * @param $unique_href_part
     *   A unique string that is expected to occur within the href of the desired
     *   link. For example, if the link URL is expected to look like
     *   "admin/config/content/formats/full_html/...", then "/full_html/" could be
     *   passed as the expected unique string.
     *
     * @return
     *   The page content that results from clicking on the link, or FALSE on
     *   failure. Failure also results in a failed assertion.
     */
    function clickTextFormatOperationLink($label, $unique_href_part) {
      $links = $this->xpath('//a[normalize-space(text())=:label]', array(':label' => $label));
      foreach ($links as $link_index => $link) {
        $position = strpos($link['href'], $unique_href_part);
        if ($position !== FALSE) {
          $index = $link_index;
          break;
        }
      }
      $this->assertTrue(isset($index), t('Link to "@label" containing @part found.', array('@label' => $label, '@part' => $unique_href_part)));
      if (isset($index)) {
        return $this->clickLink($label, $index);
      }
      else {
        return FALSE;
      }
    }

  /**
   * Tests the format administration functionality.
   */
  function testFormatAdmin() {
    // Add text format.
    $this->backdropGet('admin/config/content/formats');
    $this->clickLink('Add text format');
    $format_id = backdrop_strtolower($this->randomName());
    $name = $this->randomName();
    $edit = array(
      'format' => $format_id,
      'name' => $name,
    );
    $this->backdropPost(NULL, $edit, t('Save configuration'));

    // Attempt to create a format of the same human readable name as the
    // format but with a different machine name.
    $edit = array(
      'format' => 'new_format',
      'name' => $name,
    );
    $this->backdropPost('admin/config/content/formats/add', $edit, t('Save configuration'));
    $this->assertRaw(t('Text format names must be unique. A format named %name already exists.', array(
      '%name' => $name,
    )));

    // Verify default weight of the text format.
    $this->backdropGet('admin/config/content/formats');
    $this->assertFieldByName("formats[$format_id][weight]", 0, 'Text format weight was saved.');

    // Change the weight of the text format.
    $edit = array(
      "formats[$format_id][weight]" => 5,
    );
    $this->backdropPost('admin/config/content/formats', $edit, t('Save changes'));
    $this->assertFieldByName("formats[$format_id][weight]", 5, 'Text format weight was saved.');

    // Edit text format.
    $this->backdropGet('admin/config/content/formats');
    $this->assertLinkByHref('admin/config/content/formats/' . $format_id);
    $this->backdropGet('admin/config/content/formats/' . $format_id);
    $this->backdropPost(NULL, array(), t('Save configuration'));

    // Verify that the custom weight of the text format has been retained.
    $this->backdropGet('admin/config/content/formats');
    $this->assertFieldByName("formats[$format_id][weight]", 5, 'Text format weight was retained.');

    // Verify that the disabled section is not shown.
    $this->assertNoRaw(t('Enable'), 'A disabled text format is NOT shown.');

    // Disable text format.
    $this->assertLinkByHref('admin/config/content/formats/' . $format_id . '/disable');
    $this->backdropGet('admin/config/content/formats/' . $format_id . '/disable');
    $this->backdropPost(NULL, array(), t('Disable'));
    $this->assertRaw(t('Disabled text format %name.', array('%name' => $name)), 'Text format has been disabled.');
    $this->assertRaw(t('Enable'), 'A disabled text format is shown.');

    // Verify that the text format has been disabled. Links exist for it to be
    // enabled/configured...
    $this->assertLinkByHref('admin/config/content/formats/' . $format_id . '/enable');
    $this->assertLinkByHref('admin/config/content/formats/' . $format_id);
    // ...but no link for it to be disabled.
    $this->assertNoLinkByHref('admin/config/content/formats/' . $format_id . '/disable');

    // Enable the text format.
    $this->clickTextFormatOperationLink(t('Enable'), 'admin/config/content/formats/' . $format_id . '/enable');
    $this->assertRaw(t('Enabled text format %name.', array('%name' => $name)), 'Text format has been enabled.');

    // Verify that the text format has been enabled. Links exist for it to be
    // disabled/configured...
    $this->assertLinkByHref('admin/config/content/formats/' . $format_id);
    $this->assertLinkByHref('admin/config/content/formats/' . $format_id . '/disable');
    // ...but no link for it to be enabled.
    $this->assertNoLinkByHref('admin/config/content/formats/' . $format_id . '/enable');

    // Attempt to create a format of the same machine name as the disabled
    // format, but with a different human readable na
    $edit = array(
      'format' => $format_id,
      'name' => 'New format',
    );
    $this->backdropPost('admin/config/content/formats/add', $edit, t('Save configuration'));
    $this->assertText('The machine-readable name is already in use. It must be unique.');
  }

  /**
   * Tests filter administration functionality.
   */
  function testFilterAdmin() {
    // URL filter.
    $first_filter = 'filter_url';
    // Line filter.
    $second_filter = 'filter_autop';

    $filtered = 'filtered_html';
    $full = 'full_html';
    $plain = 'plain_text';

    // Check that the fallback format exists and cannot be disabled.
    $this->assertTrue($plain == filter_fallback_format(), 'The fallback format is set to plain text.');
    $this->backdropGet('admin/config/content/formats');
    $this->assertNoRaw('admin/config/content/formats/' . $plain . '/disable', 'Disable link for the fallback format not found.');
    $this->backdropGet('admin/config/content/formats/' . $plain . '/disable');
    $this->assertResponse(403, 'The fallback format cannot be disabled.');

    // Verify access permissions to Raw HTML (full_html) format.
    $this->assertTrue(filter_access(filter_format_load($full), $this->admin_user), 'Admin user may use Raw HTML.');
    $this->assertFalse(filter_access(filter_format_load($full), $this->web_user), 'Web user may not use Raw HTML.');

    // Add an additional tag.
    $edit = array();
    $edit['allowed_html'] = '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <quote>';
    $this->backdropPost('admin/config/content/formats/' . $filtered . '/filter-settings/filter_html', $edit, t('Update'));
    $this->backdropPost(NULL, array(), t('Save configuration'));
    $this->backdropGet('admin/config/content/formats/' . $filtered);
    $this->assertFieldByName('allowed_html', $edit['allowed_html'], 'Allowed HTML tag added.');

    $result = db_query('SELECT * FROM {cache_filter}')->fetchObject();
    $this->assertFalse($result, 'Cache cleared.');

    $elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]', array(
      ':first' => 'filters[' . $first_filter . '][weight]',
      ':second' => 'filters[' . $second_filter . '][weight]',
    ));
    $this->assertTrue(!empty($elements), 'Order confirmed in admin interface.');

    // Reorder filters.
    $edit = array();
    $edit['filters[' . $second_filter . '][weight]'] = 1;
    $edit['filters[' . $first_filter . '][weight]'] = 2;
    $this->backdropPost(NULL, $edit, t('Save configuration'));
    $this->backdropGet('admin/config/content/formats/' . $filtered);
    $this->assertFieldByName('filters[' . $second_filter . '][weight]', 1, 'Order saved successfully.');
    $this->assertFieldByName('filters[' . $first_filter . '][weight]', 2, 'Order saved successfully.');

    $elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]', array(
      ':first' => 'filters[' . $second_filter . '][weight]',
      ':second' => 'filters[' . $first_filter . '][weight]',
    ));
    $this->assertTrue(!empty($elements), 'Reorder confirmed in admin interface.');

    $config_filters = config_get('filter.format.' . $filtered, 'filters');
    backdrop_sort($config_filters, array('weight'));
    $filters = array();
    foreach ($config_filters as $filter_name => $filter) {
      if ($filter_name == $second_filter || $filter_name == $first_filter) {
        $filter['name'] = $filter_name;
        $filters[] = $filter;
      }
    }
    $this->assertTrue(($filters[0]['name'] == $second_filter && $filters[1]['name'] == $first_filter), 'Order confirmed in database.');

    // Add format.
    $edit = array();
    $edit['format'] = backdrop_strtolower($this->randomName());
    $edit['name'] = $this->randomName();
    $edit['roles[authenticated]'] = 1;
    $edit['filters[' . $second_filter . '][status]'] = TRUE;
    $edit['filters[' . $first_filter . '][status]'] = TRUE;
    $this->backdropPost('admin/config/content/formats/add', $edit, t('Save configuration'));
    $this->assertRaw(t('Added text format %format.', array('%format' => $edit['name'])), 'New filter created.');

    backdrop_static_reset('filter_formats');
    $format = filter_format_load($edit['format']);
    $this->assertNotNull($format, 'Format found in config.');
    $this->backdropGet('admin/config/content/formats/' . $edit['format']);

    $this->assertFieldByName('roles[authenticated]', '', 'Role found.');
    $this->assertFieldByName('filters[' . $second_filter . '][status]', '', 'Line break filter found.');
    $this->assertFieldByName('filters[' . $first_filter . '][status]', '', 'Url filter found.');

    // Order the new text format and check its position in the markup.
    $edit_weight = array();
    $edit_weight['formats[' . $format->format . '][weight]'] = -10;
    $edit_weight['formats[filtered_html][weight]'] = -9;
    $edit_weight['formats[full_html][weight]'] = -8;
    $edit_weight['formats[plain_text][weight]'] = 0;
    $this->backdropPost('admin/config/content/formats', $edit_weight, t('Save changes'));

    $elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]/following::select[@name=:third]/following::select[@name=:fourth]', array(
      ':first' => 'formats[' . $format->format . '][weight]',
      ':second' => 'formats[filtered_html][weight]',
      ':third' => 'formats[full_html][weight]',
      ':fourth' => 'formats[plain_text][weight]',
    ));
    $this->assertTrue(!empty($elements), 'Text format order confirmed in admin interface with new format at top.');

    // Disable the new text format.
    $this->backdropPost('admin/config/content/formats/' . $format->format . '/disable', array(), t('Disable'));
    $this->assertRaw(t('Disabled text format %format.', array('%format' => $edit['name'])), 'Format successfully disabled.');

    // Check that the disabled text format is at the bottom of the list.
    $elements = $this->xpath('//select[@name=:first]/following::select[@name=:second]/following::select[@name=:third]/following::select[@name=:fourth]', array(
      ':first' => 'formats[filtered_html][weight]',
      ':second' => 'formats[full_html][weight]',
      ':third' => 'formats[plain_text][weight]',
      ':fourth' => 'formats[' . $format->format . '][weight]',
    ));
    $this->assertTrue(!empty($elements), 'Text format order confirmed in admin interface with disabled format at bottom.');

    // Allow authenticated users on Raw HTML (full_html).
    $format = filter_format_load($full);
    $edit = array();
    $edit['roles[anonymous]'] = 0;
    $edit['roles[authenticated]'] = 1;
    $this->backdropPost('admin/config/content/formats/' . $full, $edit, t('Save configuration'));
    $this->assertRaw(t('Updated text format %format.', array('%format' => $format->name)), 'Raw HTML format successfully updated.');

    // Switch user.
    $this->backdropLogout();
    $this->backdropLogin($this->web_user);

    $this->backdropGet('node/add/page');
    // Ensure Raw HTML (full_html) is allowed.
    $this->assertRaw('<option value="' . $full . '">Raw HTML</option>', 'Raw HTML filter accessible.');

    // Switch user.
    $this->backdropLogout();
    $this->backdropLogin($this->admin_user);

    // Clean up.
    // Allowed tags.
    $edit = array();
    $edit['allowed_html'] = '<a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>';
    $this->backdropPost('admin/config/content/formats/' . $filtered . '/filter-settings/filter_html', $edit, t('Update'));
    $this->backdropPost(NULL, array(), t('Save configuration'));
    $this->backdropGet('admin/config/content/formats/' . $filtered);
    $this->assertFieldByName('allowed_html', $edit['allowed_html'], 'Allowed HTML tag added.');

    // Raw HTML (full_html).
    $edit = array();
    $edit['roles[authenticated]'] = FALSE;
    $this->backdropPost('admin/config/content/formats/' . $full, $edit, t('Save configuration'));
    $this->assertRaw(t('Updated text format %format.', array('%format' => $format->name)), 'Raw HTML format successfully reverted.');
    $this->backdropGet('admin/config/content/formats/' . $full);
    $this->assertFieldByName('roles[authenticated]', $edit['roles[authenticated]'], 'Changes reverted.');

    // Filter order.
    $edit = array();
    $edit['filters[' . $second_filter . '][weight]'] = 2;
    $edit['filters[' . $first_filter . '][weight]'] = 1;
    $this->backdropPost('admin/config/content/formats/' . $filtered, $edit, t('Save configuration'));
    $this->backdropGet('admin/config/content/formats/' . $filtered);
    $this->assertFieldByName('filters[' . $second_filter . '][weight]', $edit['filters[' . $second_filter . '][weight]'], 'Changes reverted.');
    $this->assertFieldByName('filters[' . $first_filter . '][weight]', $edit['filters[' . $first_filter . '][weight]'], 'Changes reverted.');

    // Switch user.
    $this->backdropLogout();
    $this->backdropLogin($this->web_user);

    // Use filtered HTML and see if it removes tags that are not allowed.
    $body = '<em>' . $this->randomName() . '</em>';
    $extra_text = 'text';
    $text = $body . '<random>' . $extra_text . '</random>';

    $edit = array();
    $langcode = LANGUAGE_NONE;
    $edit["title"] = $this->randomName();
    $edit["body[$langcode][0][value]"] = $text;
    $edit["body[$langcode][0][format]"] = $filtered;
    $this->backdropPost('node/add/page', $edit, t('Save'));
    $this->assertRaw(t('Page %title has been created.', array('%title' => $edit["title"])), 'Filtered node created.');

    $node = $this->backdropGetNodeByTitle($edit["title"]);
    $this->assertTrue($node, 'Node found in database.');

    $this->backdropGet('node/' . $node->nid);
    $this->assertRaw($body . $extra_text, 'Filter removed invalid tag.');

    // Use plain text and see if it escapes all tags, whether allowed or not.
    foreach (filter_formats() as $format) {
      if ($format->format != filter_fallback_format()) {
        filter_format_disable($format);
      }
    }

    $edit = array();
    $langcode = LANGUAGE_NONE;
    $edit["title"] = $this->randomName();
    $edit["body[$langcode][0][value]"] = $text;
    $this->backdropPost('node/add/page', $edit, t('Save'));
    $this->assertText(check_plain($text), 'The "Plain text" text format escapes all HTML tags.');
  }

  /**
   * Tests the URL filter settings form is properly validated.
   */
  function testUrlFilterAdmin() {
    // The form does not save with an invalid filter URL length.
    $edit = array(
      'filter_url_length' => $this->randomName(4),
    );
    $this->backdropPost('admin/config/content/formats/filtered_html/filter-settings/filter_url', $edit, t('Update'));
    $this->assertNoRaw(t('The text format %format has been updated.', array('%format' => 'Basic')));

    // The form does save permitted value and it appears in the config json.
    $length = 88;
    $edit_setting = array(
      'filter_url_length' => $length,
    );
    $this->backdropPost('admin/config/content/formats/filtered_html/filter-settings/filter_url', $edit_setting, t('Update'));
    $this->backdropPost('admin/config/content/formats/filtered_html', array(), t('Save configuration'));
    $saved_length = config_get('filter.format.filtered_html', 'filters.filter_url.settings.filter_url_length');
    $this->assertEqual($saved_length, $length, 'Filter url length saved to config file.');

    // Make sure consecutive settings form submits do not discard
    // previously added settings.
    $length = 102;
    $edit_url = array(
      'filter_url_length' => $length,
    );
    $edit_html = array(
      'filter_html_nofollow' => TRUE,
    );
    $this->backdropPost('admin/config/content/formats/filtered_html/filter-settings/filter_url', $edit_url, t('Update'));
    $this->backdropPost('admin/config/content/formats/filtered_html/filter-settings/filter_html', $edit_html, t('Update'));
    $this->backdropPost('admin/config/content/formats/filtered_html', array(), t('Save configuration'));
    $url_length = config_get('filter.format.filtered_html', 'filters.filter_url.settings.filter_url_length');
    $this->assertEqual($url_length, $length, 'Filter url not overridden by consecutive form post.');
    $nofollow = config_get('filter.format.filtered_html', 'filters.filter_html.settings.filter_html_nofollow');
    $this->assertTrue($nofollow, 'Consecutive settings form post saved correctly');
  }
}

/**
 * Tests the filter format access functionality in the Filter module.
 */
class FilterFormatAccessTestCase extends BackdropWebTestCase {
  /**
   * A user with administrative permissions.
   *
   * @var object
   */
  protected $admin_user;

  /**
   * A user with 'administer filters' permission.
   *
   * @var object
   */
  protected $filter_admin_user;

  /**
   * A user with permission to create and edit own content.
   *
   * @var object
   */
  protected $web_user;

  /**
   * An object representing an allowed text format.
   *
   * @var object
   */
  protected $allowed_format;

  /**
   * An object representing a disallowed text format.
   *
   * @var object
   */
  protected $disallowed_format;

  function setUp() {
    parent::setUp();

    // Create a user who can administer text formats, but does not have
    // specific permission to use any of them.
    $this->filter_admin_user = $this->backdropCreateUser(array(
      'administer filters',
      'create page content',
      'edit any page content',
    ));

    // Create three text formats.
    $this->backdropLogin($this->filter_admin_user);
    $formats = array();
    for ($i = 0; $i < 3; $i++) {
      $edit = array(
        'format' => backdrop_strtolower($this->randomName()),
        'name' => $this->randomName(),
      );
      $this->backdropPost('admin/config/content/formats/add', $edit, t('Save configuration'));
      $this->resetFilterCaches();
      $formats[] = filter_format_load($edit['format']);
    }
    list($this->allowed_format, $this->disallowed_format) = $formats;
    $this->backdropLogout();

    // Create a regular user with access to one of the formats.
    $this->web_user = $this->backdropCreateUser(array(
      'create page content',
      'edit any page content',
      filter_permission_name($this->allowed_format),
    ));

    // Create an administrative user who has access to use all formats.
    $this->admin_user = $this->backdropCreateUser(array(
      'administer filters',
      'create page content',
      'edit any page content',
      filter_permission_name($this->allowed_format),
      filter_permission_name($this->disallowed_format),
    ));
  }

  /**
   * Tests the Filter format access permissions functionality.
   */
  function testFormatPermissions() {
    // Make sure that a regular user only has access to the text format they
    // were granted access to, as well to the fallback format.
    $this->assertTrue(filter_access($this->allowed_format, $this->web_user), 'A regular user has access to a text format they were granted access to.');
    $this->assertFalse(filter_access($this->disallowed_format, $this->web_user), 'A regular user does not have access to a text format they were not granted access to.');
    $this->assertTrue(filter_access(filter_format_load(filter_fallback_format()), $this->web_user), 'A regular user has access to the fallback format.');

    // Perform similar checks as above, but now against the entire list of
    // available formats for this user.
    $this->assertTrue(in_array($this->allowed_format->format, array_keys(filter_formats($this->web_user))), 'The allowed format appears in the list of available formats for a regular user.');
    $this->assertFalse(in_array($this->disallowed_format->format, array_keys(filter_formats($this->web_user))), 'The disallowed format does not appear in the list of available formats for a regular user.');
    $this->assertTrue(in_array(filter_fallback_format(), array_keys(filter_formats($this->web_user))), 'The fallback format appears in the list of available formats for a regular user.');

    // Make sure that a regular user only has permission to use the format
    // they were granted access to.
    $this->assertTrue(user_access(filter_permission_name($this->allowed_format), $this->web_user), 'A regular user has permission to use the allowed text format.');
    $this->assertFalse(user_access(filter_permission_name($this->disallowed_format), $this->web_user), 'A regular user does not have permission to use the disallowed text format.');

    // Make sure that the allowed format appears on the node form and that
    // the disallowed format does not.
    $this->backdropLogin($this->web_user);
    $this->backdropGet('node/add/page');
    $langcode = LANGUAGE_NONE;
    $elements = $this->xpath('//select[@name=:name]/option', array(
      ':name' => "body[$langcode][0][format]",
      ':option' => $this->allowed_format->format,
    ));
    $options = array();
    foreach ($elements as $element) {
      $options[(string) $element['value']] = $element;
    }
    $this->assertTrue(isset($options[$this->allowed_format->format]), 'The allowed text format appears as an option when adding a new node.');
    $this->assertFalse(isset($options[$this->disallowed_format->format]), 'The disallowed text format does not appear as an option when adding a new node.');
    $this->assertFalse(isset($options[filter_fallback_format()]), 'The fallback format does not appear as an option when adding a new node.');

    // Check regular user access to the filter tips pages.
    $this->backdropGet('filter/tips/' . $this->allowed_format->format);
    $this->assertResponse(200);
    $this->backdropGet('filter/tips/' . $this->disallowed_format->format);
    $this->assertResponse(403);
    $this->backdropGet('filter/tips/' . filter_fallback_format());
    $this->assertResponse(200);
    $this->backdropGet('filter/tips/invalid-format');
    $this->assertResponse(404);

    // Check admin user access to the filter tips pages.
    $this->backdropLogin($this->admin_user);
    $this->backdropGet('filter/tips/' . $this->allowed_format->format);
    $this->assertResponse(200);
    $this->backdropGet('filter/tips/' . $this->disallowed_format->format);
    $this->assertResponse(200);
    $this->backdropGet('filter/tips/' . filter_fallback_format());
    $this->assertResponse(200);
    $this->backdropGet('filter/tips/invalid-format');
    $this->assertResponse(404);
  }

  /**
   * Tests if text format is available to a role.
   */
  function testFormatRoles() {
    // Get the role name assigned to the regular user.
    $roles = array_diff($this->web_user->roles, array(BACKDROP_AUTHENTICATED_ROLE));
    $role_name = reset($roles);

    // Check that this role appears in the list of roles that have access to an
    // allowed text format, but does not appear in the list of roles that have
    // access to a disallowed text format.
    $this->assertTrue(in_array($role_name, filter_get_roles_by_format($this->allowed_format)), 'A role which has access to a text format appears in the list of roles that have access to that format.');
    $this->assertFalse(in_array($role_name, filter_get_roles_by_format($this->disallowed_format)), 'A role which does not have access to a text format does not appear in the list of roles that have access to that format.');

    // Check that the correct text format appears in the list of formats
    // available to that role.
    $this->assertTrue(in_array($this->allowed_format->format, array_keys(filter_get_formats_by_role($role_name))), 'A text format which a role has access to appears in the list of formats available to that role.');
    $this->assertFalse(in_array($this->disallowed_format->format, array_keys(filter_get_formats_by_role($role_name))), 'A text format which a role does not have access to does not appear in the list of formats available to that role.');

    // Check that the fallback format is always allowed.
    $this->assertEqual(filter_get_roles_by_format(filter_format_load(filter_fallback_format())), array_keys(user_roles()), 'All roles have access to the fallback format.');
    $this->assertTrue(in_array(filter_fallback_format(), array_keys(filter_get_formats_by_role($role_name))), 'The fallback format appears in the list of allowed formats for any role.');
  }

  /**
   * Tests editing a page using a disallowed text format.
   *
   * Verifies that regular users and administrators are able to edit a page, but
   * not allowed to change the fields which use an inaccessible text format.
   * Also verifies that fields which use a text format that does not exist can
   * be edited by administrators only, but that the administrator is forced to
   * choose a new format before saving the page.
   */
  function testFormatWidgetPermissions() {
    config_set('path.settings', 'node_pattern', '');
    config_set('path.settings', 'node_page_pattern', '');

    $langcode = LANGUAGE_NONE;
    $body_value_key = "body[$langcode][0][value]";
    $body_format_key = "body[$langcode][0][format]";

    // Create node to edit.
    $this->backdropLogin($this->admin_user);
    $edit = array();
    $edit['title'] = $this->randomName(8);
    $edit[$body_value_key] = $this->randomName(16);
    $edit[$body_format_key] = $this->disallowed_format->format;
    $this->backdropPost('node/add/page', $edit, t('Save'));
    $node = $this->backdropGetNodeByTitle($edit['title']);

    // Try to edit with a less privileged user.
    $this->backdropLogin($this->web_user);
    $this->backdropGet('node/' . $node->nid);
    $this->clickLink(t('Edit'));

    // Verify that body field is read-only and contains replacement value.
    $this->assertFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", t('This field has been disabled because you do not have sufficient permissions to edit it.'), 'Text format access denied message found.');

    // Change the title and verify that only the title was changed.
    $new_edit = array();
    $new_edit['title'] = $this->randomName(8);
    $this->backdropPost(NULL, $new_edit, t('Save'));
    $this->assertNoText($edit['title'], 'Old title not found.');
    $this->assertText($new_edit['title'], 'New title found.');
    $this->assertText($edit[$body_value_key], 'Old body found.');

    // Check that even an administrator with "administer filters" permission
    // cannot edit the body field if they do not have specific permission to
    // use its stored format. (This must be disallowed so that the
    // administrator is never forced to switch the text format to something
    // else.)
    $this->backdropLogin($this->filter_admin_user);
    $this->backdropGet('node/' . $node->nid . '/edit');
    $this->assertFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", t('This field has been disabled because you do not have sufficient permissions to edit it.'), 'Text format access denied message found.');

    // Disable the text format used above.
    filter_format_disable($this->disallowed_format);
    $this->resetFilterCaches();

    // Log back in as the less privileged user and verify that the body field
    // is still disabled, since the less privileged user should not be able to
    // edit content that does not have an assigned format.
    $this->backdropLogin($this->web_user);
    $this->backdropGet('node/' . $node->nid . '/edit');
    $this->assertFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", t('This field has been disabled because you do not have sufficient permissions to edit it.'), 'Text format access denied message found.');

    // Log back in as the filter administrator and verify that the body field
    // can be edited.
    $this->backdropLogin($this->filter_admin_user);
    $this->backdropGet('node/' . $node->nid . '/edit');
    $this->assertNoFieldByXPath("//textarea[@name='$body_value_key' and @disabled='disabled']", NULL, 'Text format access denied message not found.');
    $this->assertFieldByXPath("//select[@name='$body_format_key']", NULL, 'Text format selector found.');

    // Verify that trying to save the node without selecting a new text format
    // produces an error message, and does not result in the node being saved.
    $old_title = $new_edit['title'];
    $new_title = $this->randomName(8);
    $edit = array('title' => $new_title);
    $this->backdropPost('node/' . $node->nid . '/edit', $edit, t('Save'));
    $this->assertText(t('!name field is required.', array('!name' => t('Editor'))), 'Error message is displayed.');
    $this->backdropGet('node/' . $node->nid);
    $this->assertText($old_title, 'Old title found.');
    $this->assertNoText($new_title, 'New title not found.');

    // Now select a new text format and make sure the node can be saved.
    $this->backdropLogin($this->admin_user);
    $edit[$body_format_key] = $this->allowed_format->format;
    $this->backdropPost('node/' . $node->nid . '/edit', $edit, t('Save'));
    $this->assertUrl('node/' . $node->nid);
    $this->assertText($new_title, 'New title found.');
    $this->assertNoText($old_title, 'Old title not found.');

    // Then disable that format and all other formats on the site (leaving only
    // the fallback format).
    foreach (filter_formats() as $format) {
      if ($format->format != filter_fallback_format()) {
        filter_format_disable($format);
      }
    }

    // Since there is now only one available text format, the widget for
    // selecting a text format would normally not display when the content is
    // edited. However, we need to verify that the filter administrator still
    // is forced to make a conscious choice to reassign the text to a different
    // format.
    $this->backdropLogin($this->filter_admin_user);
    $old_title = $new_title;
    $new_title = $this->randomName(8);
    $edit = array('title' => $new_title);
    $this->backdropPost('node/' . $node->nid . '/edit', $edit, t('Save'));
    $this->assertText(t('!name field is required.', array('!name' => t('Editor'))), 'Error message is displayed.');
    $this->backdropGet('node/' . $node->nid);
    $this->assertText($old_title, 'Old title found.');
    $this->assertNoText($new_title, 'New title not found.');
    $edit[$body_format_key] = filter_fallback_format();
    $this->backdropPost('node/' . $node->nid . '/edit', $edit, t('Save'));
    $this->assertUrl('node/' . $node->nid);
    $this->assertText($new_title, 'New title found.');
    $this->assertNoText($old_title, 'Old title not found.');
  }

  /**
   * Tests loading of disabled formats.
   */
  function testFormatDisabledAccess() {
    // Check filter_formats() in sequence loading both enabled and all formats.
    filter_format_disable($this->disallowed_format);
    $this->resetFilterCaches();

    $enabled_formats = filter_formats();
    $this->assertEqual(count($enabled_formats), 5);

    $all_formats = filter_formats(NULL, TRUE);
    $this->assertEqual(count($all_formats), 6);

    $user_enabled_formats = filter_formats($this->admin_user);
    $this->assertEqual(count($user_enabled_formats), 3);

    $user_all_formats = filter_formats($this->admin_user, TRUE);
    $this->assertEqual(count($user_all_formats), 4);
  }

  /**
   * Rebuilds text format and permission caches in the thread running the tests.
   */
  protected function resetFilterCaches() {
    filter_formats_reset();
    $this->checkPermissions(array(), TRUE);
  }
}

/**
 * Tests the default filter functionality in the Filter module.
 */
class FilterDefaultFormatTestCase extends BackdropWebTestCase {
  /**
   * Tests if the default text format is accessible to users.
   */
  function testDefaultTextFormats() {
    // Create two text formats, and two users. The first user has access to
    // both formats, but the second user only has access to the second one.
    $admin_user = $this->backdropCreateUser(array('administer filters'));
    $this->backdropLogin($admin_user);
    $formats = array();
    for ($i = 0; $i < 2; $i++) {
      $edit = array(
        'format' => backdrop_strtolower($this->randomName()),
        'name' => $this->randomName(),
      );
      $this->backdropPost('admin/config/content/formats/add', $edit, t('Save configuration'));
      $this->resetFilterCaches();
      $formats[] = filter_format_load($edit['format']);
    }
    list($first_format, $second_format) = $formats;
    $first_user = $this->backdropCreateUser(array(filter_permission_name($first_format), filter_permission_name($second_format)));
    $second_user = $this->backdropCreateUser(array(filter_permission_name($second_format)));

    // Adjust the weights so that the first and second formats (in that order)
    // are the two lowest weighted formats available to any user.
    $edit = array();
    $edit['formats[' . $first_format->format . '][weight]'] = '-2';
    $edit['formats[' . $second_format->format . '][weight]'] = '-1';
    $this->backdropPost('admin/config/content/formats', $edit, t('Save changes'));
    $this->resetFilterCaches();

    // Check that each user's default format is the lowest weighted format that
    // the user has access to.
    $this->assertEqual(filter_default_format($first_user), $first_format->format, "The first user's default format is the lowest weighted format that the user has access to.");
    $this->assertEqual(filter_default_format($second_user), $second_format->format, "The second user's default format is the lowest weighted format that the user has access to, and is different than the first user's.");

    // Reorder the two formats, and check that both users now have the same
    // default.
    $edit = array();
    $edit['formats[' . $second_format->format . '][weight]'] = '-3';
    $this->backdropPost('admin/config/content/formats', $edit, t('Save changes'));
    $this->resetFilterCaches();
    $this->assertEqual(filter_default_format($first_user), filter_default_format($second_user), 'After the formats are reordered, both users have the same default format.');
  }

  /**
   * Rebuilds text format and permission caches in the thread running the tests.
   */
  protected function resetFilterCaches() {
    filter_formats_reset();
    $this->checkPermissions(array(), TRUE);
  }
}

/**
 * Tests the behavior of check_markup() when it is called without text format.
 */
class FilterNoFormatTestCase extends BackdropWebTestCase {
  /**
   * Tests text without format.
   *
   * Tests if text with no format is filtered the same way as text in the
   * fallback format.
   */
  function testCheckMarkupNoFormat() {
    // Create some text. Include some HTML and line breaks, so we get a good
    // test of the filtering that is applied to it.
    $text = "<strong>" . $this->randomName(32) . "</strong>\n\n<div>" . $this->randomName(32) . "</div>";

    // Make sure that when this text is run through check_markup() with no text
    // format, it is filtered as though it is in the fallback format.
    $this->assertEqual(check_markup($text), check_markup($text, filter_fallback_format()), 'Text with no format is filtered the same as text in the fallback format.');
  }
}

/**
 * Security tests for missing/vanished text formats or filters.
 */
class FilterSecurityTestCase extends BackdropWebTestCase {

  /**
   * @var User
   */
  protected $admin_user;

  function setUp() {
    parent::setUp('filter_test');
    $this->admin_user = $this->backdropCreateUser(array('administer modules', 'administer filters', 'administer site configuration'));
    $this->backdropLogin($this->admin_user);
  }

  /**
   * Tests removal of filtered content when an active filter is disabled.
   *
   * Tests that filtered content is emptied when an actively used filter module
   * is disabled.
   */
  function testDisableFilterModule() {
    // Create a new node.
    $node = $this->backdropCreateNode(array('promote' => 1));
    $body_raw = $node->body[LANGUAGE_NONE][0]['value'];
    $format_id = $node->body[LANGUAGE_NONE][0]['format'];
    $this->backdropGet('node/' . $node->nid);
    $this->assertText($body_raw, 'Node body found.');

    // Enable the filter_test_replace filter.
    $edit = array(
      'filters[filter_test_replace][status]' => 1,
    );
    $this->backdropPost('admin/config/content/formats/' . $format_id, $edit, t('Save configuration'));

    // Remove the entity cache entry for the node so that field_attach_load can
    // run again and the filters can be re-applied.
    cache('entity_node')->delete($node->nid);

    // Verify that filter_test_replace filter replaced the content.
    $this->backdropGet('node/' . $node->nid);
    $this->assertNoText($body_raw, 'Node body not found.');
    $this->assertText('Filter: filter_test_replace', 'Testing filter output found.');

    // Disable the text format entirely.
    $this->backdropPost('admin/config/content/formats/' . $format_id . '/disable', array(), t('Disable'));

    // Remove the entity cache entry for the node so that field_attach_load can
    // run again and the filters can be re-applied.
    cache('entity_node')->delete($node->nid);

    // Verify that the content is empty, because the text format does not exist.
    $this->backdropGet('node/' . $node->nid);
    $this->assertNoText($body_raw, 'Node body not found.');
  }
}

/**
 * Unit tests for core filters.
 */
class FilterUnitTestCase extends BackdropUnitTestCase {
  /**
   * Tests the line break filter.
   */
  function testLineBreakFilter() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->callback = '_filter_autop';

    // Since the line break filter naturally needs plenty of newlines in test
    // strings and expectations, we're using "\n" instead of regular newlines
    // here.
    $tests = array(
      // Single line breaks should be changed to <br /> tags, while paragraphs
      // separated with double line breaks should be enclosed with <p></p> tags.
      "aaa\nbbb\n\nccc" => array(
        "<p>aaa<br />\nbbb</p>\n<p>ccc</p>" => TRUE,
      ),
      // Skip contents of certain block tags entirely.
      "<script>aaa\nbbb\n\nccc</script>
<style>aaa\nbbb\n\nccc</style>
<pre>aaa\nbbb\n\nccc</pre>
<object>aaa\nbbb\n\nccc</object>
<iframe>aaa\nbbb\n\nccc</iframe>
" => array(
        "<script>aaa\nbbb\n\nccc</script>" => TRUE,
        "<style>aaa\nbbb\n\nccc</style>" => TRUE,
        "<pre>aaa\nbbb\n\nccc</pre>" => TRUE,
        "<object>aaa\nbbb\n\nccc</object>" => TRUE,
        "<iframe>aaa\nbbb\n\nccc</iframe>" => TRUE,
      ),
      // Skip comments entirely.
      "One. <!-- comment --> Two.\n<!--\nThree.\n-->\n" => array(
        '<!-- comment -->' => TRUE,
        "<!--\nThree.\n-->" => TRUE,
      ),
      // Resulting HTML should produce matching paragraph tags.
      '<p><div>  </div></p>' => array(
        "<p>\n<div>  </div>\n</p>" => TRUE,
      ),
      '<div><p>  </p></div>' => array(
        "<div>\n</div>" => TRUE,
      ),
      '<blockquote><pre>aaa</pre></blockquote>' => array(
        "<blockquote><pre>aaa</pre></blockquote>" => TRUE,
      ),
      "<pre>aaa\nbbb\nccc</pre>\nddd\neee" => array(
        "<pre>aaa\nbbb\nccc</pre>" => TRUE,
        "<p>ddd<br />\neee</p>" => TRUE,
      ),
      // Comments remain unchanged and subsequent lines/paragraphs are
      // transformed normally.
      "aaa<!--comment-->\n\nbbb\n\nccc\n\nddd<!--comment\nwith linebreak-->\n\neee\n\nfff" => array(
        "<p>aaa</p>\n<!--comment--><p>\nbbb</p>\n<p>ccc</p>\n<p>ddd</p>" => TRUE,
        "<!--comment\nwith linebreak--><p>\neee</p>\n<p>fff</p>" => TRUE,
      ),
      // Check that a comment in a PRE will result that the text after
      // the comment, but still in PRE, is not transformed.
      "<pre>aaa\nbbb<!-- comment -->\n\nccc</pre>\nddd" => array(
        "<pre>aaa\nbbb<!-- comment -->\n\nccc</pre>" => TRUE,
      ),
      // Bug 810824, paragraphs were appearing around iframe tags.
      "<iframe>aaa</iframe>\n\n" => array(
        "<p><iframe>aaa</iframe></p>" => FALSE,
      ),
      // Check that tags that close on a separate line do not get an extra
      // <br /> before the closing tag. This is the default formatting output by
      // CKEditor 5 in Backdrop.
      "<h3>\n    indented line\n</h3>" => array(
        "<h3>\n    indented line\n</h3>" => TRUE,
        "<h3>\n    indented line<br />\n</h3>" => FALSE,
      ),
      // Check that new lines within block elements have <br /> tags added, but
      // not before the closing tag on a new line.
      "<p>\n    indented line\n    second indented line\n</p>" => array(
        "<p>\n    indented line<br />\n    second indented line\n</p>" => TRUE,
        "<p>\n    indented line<br />\n    second indented line<br />\n</p>" => FALSE,
        "<p>\n    indented line\n    second indented line\n</p>" => FALSE,
      ),
      // Check that manually added <br> tags at end of lines don't duplicate
      // another <br /> tag after them. Line breaks are normalized from <br>
      // to <br /> as part of this filter.
      "<p>\n    line before break<br>\n    line after break</p>" => array(
        "<p>\n    line before break<br />\n    line after break</p>"  => TRUE,
        "<p>\n    line before break<br><br />\n    line after break</p>"  => FALSE,
        "<p>\n    line before break<br /><br />\n    line after break</p>"  => FALSE,
      ),
    );
    $this->assertFilteredString($filter, $tests);

    // Very long string hitting PCRE limits.
    $limit = max(ini_get('pcre.backtrack_limit'), ini_get('pcre.recursion_limit'));
    $source = $this->randomName($limit);
    $result = _filter_autop($source);
    $success = $this->assertEqual($result, '<p>' . $source . "</p>\n", 'Line break filter can process very long strings.');
    if (!$success) {
      $this->verbose("\n" . $source . "\n<hr />\n" . $result);
    }
  }

  /**
   * Tests limiting allowed tags and XSS prevention.
   *
   * XSS tests assume that script is disallowed by default and src is allowed
   * by default, but on* and style attributes are disallowed.
   *
   * Script injection vectors mostly adopted from http://ha.ckers.org/xss.html.
   *
   * Relevant CVEs:
   * - CVE-2002-1806, ~CVE-2005-0682, ~CVE-2005-2106, CVE-2005-3973,
   *   CVE-2006-1226 (= rev. 1.112?), CVE-2008-0273, CVE-2008-3740.
   */
  function testFilterXSS() {
    // Tag stripping, different ways to work around removal of HTML tags.
    $f = filter_xss('<script>alert(0)</script>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping -- simple script without special characters.');

    $f = filter_xss('<script src="http://www.example.com" />');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping -- empty script with source.');

    $f = filter_xss('<ScRipt sRc=http://www.example.com/>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- varying case.');

    $f = filter_xss("<script\nsrc\n=\nhttp://www.example.com/\n>");
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- multiline tag.');

    $f = filter_xss('<script/a src=http://www.example.com/a.js></script>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- non whitespace character after tag name.');

    $f = filter_xss('<script/src=http://www.example.com/a.js></script>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no space between tag and attribute.');

    // Null between < and tag name works at least with IE6.
    $f = filter_xss("<\0scr\0ipt>alert(0)</script>");
    $this->assertNoNormalized($f, 'ipt', 'HTML tag stripping evasion -- breaking HTML with nulls.');

    $f = filter_xss("<scrscriptipt src=http://www.example.com/a.js>");
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- filter just removing "script".');

    $f = filter_xss('<<script>alert(0);//<</script>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- double opening brackets.');

    $f = filter_xss('<script src=http://www.example.com/a.js?<b>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no closing tag.');

    // DRUPAL-SA-2008-047: This doesn't seem exploitable, but the filter should
    // work consistently.
    $f = filter_xss('<script>>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- double closing tag.');

    $f = filter_xss('<script src=//www.example.com/.a>');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no scheme or ending slash.');

    $f = filter_xss('<script src=http://www.example.com/.a');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- no closing bracket.');

    $f = filter_xss('<script src=http://www.example.com/ <');
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- opening instead of closing bracket.');

    $f = filter_xss('<nosuchtag attribute="newScriptInjectionVector">');
    $this->assertNoNormalized($f, 'nosuchtag', 'HTML tag stripping evasion -- unknown tag.');

    $f = filter_xss('<?xml:namespace ns="urn:schemas-microsoft-com:time">');
    $this->assertTrue(stripos($f, '<?xml') === FALSE, 'HTML tag stripping evasion -- starting with a question sign (processing instructions).');

    $f = filter_xss('<t:set attributeName="innerHTML" to="&lt;script defer&gt;alert(0)&lt;/script&gt;">');
    $this->assertNoNormalized($f, 't:set', 'HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).');

    $f = filter_xss('<img """><script>alert(0)</script>', array('img'));
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- a malformed image tag.');

    $f = filter_xss('<blockquote><script>alert(0)</script></blockquote>', array('blockquote'));
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- script in a blockquote.');

    $f = filter_xss("<!--[if true]><script>alert(0)</script><![endif]-->");
    $this->assertNoNormalized($f, 'script', 'HTML tag stripping evasion -- script within a comment.');

    // Dangerous attributes removal.
    $f = filter_xss('<p onmouseover="http://www.example.com/">', array('p'));
    $this->assertNoNormalized($f, 'onmouseover', 'HTML filter attributes removal -- events, no evasion.');

    $f = filter_xss('<li style="list-style-image: url(javascript:alert(0))">', array('li'));
    $this->assertNoNormalized($f, 'style', 'HTML filter attributes removal -- style, no evasion.');

    $f = filter_xss('<img onerror   =alert(0)>', array('img'));
    $this->assertNoNormalized($f, 'onerror', 'HTML filter attributes removal evasion -- spaces before equals sign.');

    $f = filter_xss('<img onabort!#$%&()*~+-_.,:;?@[/|\]^`=alert(0)>', array('img'));
    $this->assertNoNormalized($f, 'onabort', 'HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.');

    $f = filter_xss('<img oNmediAError=alert(0)>', array('img'));
    $this->assertNoNormalized($f, 'onmediaerror', 'HTML filter attributes removal evasion -- varying case.');

    // Works at least with IE6.
    $f = filter_xss("<img o\0nfocus\0=alert(0)>", array('img'));
    $this->assertNoNormalized($f, 'focus', 'HTML filter attributes removal evasion -- breaking with nulls.');

    // Only allowed scheme names allowed in attributes.
    $f = filter_xss('<img src="javascript:alert(0)">', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- no evasion.');

    $f = filter_xss('<img src=javascript:alert(0)>', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- no quotes.');

    // A bit like CVE-2006-0070.
    $f = filter_xss('<img src="javascript:confirm(0)">', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- no alert ;)');

    $f = filter_xss('<img src=`javascript:alert(0)`>', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- grave accents.');

    $f = filter_xss('<img dynsrc="javascript:alert(0)">', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- rare attribute.');

    $f = filter_xss('<table background="javascript:alert(0)">', array('table'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- another tag.');

    $f = filter_xss('<base href="javascript:alert(0);//">', array('base'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing -- one more attribute and tag.');

    $f = filter_xss('<img src="jaVaSCriPt:alert(0)">', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- varying case.');

    $f = filter_xss('<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#48;&#41;>', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- UTF-8 decimal encoding.');

    $f = filter_xss('<img src=&#00000106&#0000097&#00000118&#0000097&#00000115&#0000099&#00000114&#00000105&#00000112&#00000116&#0000058&#0000097&#00000108&#00000101&#00000114&#00000116&#0000040&#0000048&#0000041>', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- long UTF-8 encoding.');

    $f = filter_xss('<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x30&#x29>', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- UTF-8 hex encoding.');

    $f = filter_xss("<img src=\"jav\tascript:alert(0)\">", array('img'));
    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an embedded tab.');

    $f = filter_xss('<img src="jav&#x09;ascript:alert(0)">', array('img'));
    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an encoded, embedded tab.');

    $f = filter_xss('<img src="jav&#x000000A;ascript:alert(0)">', array('img'));
    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an encoded, embedded newline.');

    // With &#xD; this test would fail, but the entity gets turned into
    // &amp;#xD;, so it's OK.
    $f = filter_xss('<img src="jav&#x0D;ascript:alert(0)">', array('img'));
    $this->assertNoNormalized($f, 'script', 'HTML scheme clearing evasion -- an encoded, embedded carriage return.');

    $f = filter_xss("<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">", array('img'));
    $this->assertNoNormalized($f, 'cript', 'HTML scheme clearing evasion -- broken into many lines.');

    $f = filter_xss("<img src=\"jav\0a\0\0cript:alert(0)\">", array('img'));
    $this->assertNoNormalized($f, 'cript', 'HTML scheme clearing evasion -- embedded nulls.');

    // Note that with &#14; this fails in PHP 5.4+. Work-around solutions are
    // being discussed in https://www.drupal.org/node/1210798.
    $f = filter_xss('<img src=" &#x09;  javascript:alert(0)">', array('img'));
    $this->assertNoNormalized($f, 'javascript', 'HTML scheme clearing evasion -- spaces and metacharacters before scheme.');

    $f = filter_xss('<img src="vbscript:msgbox(0)">', array('img'));
    $this->assertNoNormalized($f, 'vbscript', 'HTML scheme clearing evasion -- another scheme.');

    $f = filter_xss('<img src="nosuchscheme:notice(0)">', array('img'));
    $this->assertNoNormalized($f, 'nosuchscheme', 'HTML scheme clearing evasion -- unknown scheme.');

    // Netscape 4.x javascript entities.
    $f = filter_xss('<br size="&{alert(0)}">', array('br'));
    $this->assertNoNormalized($f, 'alert', 'Netscape 4.x javascript entities.');

    // DRUPAL-SA-2008-006: Invalid UTF-8, these only work as reflected XSS with
    // Internet Explorer 6.
    $f = filter_xss("<p arg=\"\xe0\">\" style=\"background-image: url(javascript:alert(0));\"\xe0<p>", array('p'));
    $this->assertNoNormalized($f, 'style', 'HTML filter -- invalid UTF-8.');

    $f = filter_xss("\xc0aaa");
    $this->assertEqual($f, '', 'HTML filter -- overlong UTF-8 sequences.');

    $f = filter_xss("Who&#039;s Online");
    $this->assertNormalized($f, "who's online", 'HTML filter -- html entity number');

    $f = filter_xss("Who&amp;#039;s Online");
    $this->assertNormalized($f, "who&#039;s online", 'HTML filter -- encoded html entity number');

    $f = filter_xss("Who&amp;amp;#039; Online");
    $this->assertNormalized($f, "who&amp;#039; online", 'HTML filter -- double encoded html entity number');
  }

  /**
   * Tests filter settings, defaults, access restrictions and similar.
   *
   * @todo This is for functions like filter_filter and check_markup, whose
   *   functionality is not completely focused on filtering. Some ideas:
   *   restricting formats according to user permissions, proper cache
   *   handling, defaults -- allowed tags/attributes/protocols.
   *
   * @todo It is possible to add script, iframe etc. to allowed tags, but this
   *   makes HTML filter completely ineffective.
   *
   * @todo Class, id, name and xmlns should be added to disallowed attributes,
   *   or better, an allowed attributes approach should be used for that too.
   */
  function testHtmlFilter() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->settings = array(
      'allowed_html' => '<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd> <h3> <h4> <h5> <p> <test-element>',
      'filter_html_help' => 1,
      'filter_html_nofollow' => 0,
    );

    // HTML filter is not able to secure some tags, these should never be
    // allowed.
    $f = _filter_html('<script />', $filter);
    $this->assertNoNormalized($f, 'script', 'HTML filter should always remove script tags.');

    $f = _filter_html('<iframe />', $filter);
    $this->assertNoNormalized($f, 'iframe', 'HTML filter should always remove iframe tags.');

    $f = _filter_html('<object />', $filter);
    $this->assertNoNormalized($f, 'object', 'HTML filter should always remove object tags.');

    $f = _filter_html('<style />', $filter);
    $this->assertNoNormalized($f, 'style', 'HTML filter should always remove style tags.');

    // Some tags make CSRF attacks easier, let the user take the risk herself.
    $f = _filter_html('<img />', $filter);
    $this->assertNoNormalized($f, 'img', 'HTML filter should remove img tags on default.');

    $f = _filter_html('<input />', $filter);
    $this->assertNoNormalized($f, 'img', 'HTML filter should remove input tags on default.');

    // Filtering content of some attributes is infeasible, these shouldn't be
    // allowed too.
    $f = _filter_html('<p style="display: none;" />', $filter);
    $this->assertNoNormalized($f, 'style', 'HTML filter should remove style attribute on default.');

    $f = _filter_html('<p onerror="alert(0);" />', $filter);
    $this->assertNoNormalized($f, 'onerror', 'HTML filter should remove on* attributes on default.');

    $f = _filter_html('<code onerror>&nbsp;</code>', $filter);
    $this->assertNoNormalized($f, 'onerror', 'HTML filter should remove empty on* attributes on default.');

    // Custom tags are supported and should be allowed through.
    $f = _filter_html('<test-element></test-element>', $filter);
    $this->assertNormalized($f, 'test-element', 'HTML filter should allow custom elements.');
  }

  /**
   * Tests the spam deterrent.
   */
  function testNoFollowFilter() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->settings = array(
      'allowed_html' => '<a>',
      'filter_html_help' => 1,
      'filter_html_nofollow' => 1,
    );

    // Test if the rel="nofollow" attribute is added, even if we try to prevent
    // it.
    $f = _filter_html('<a href="http://www.example.com/">text</a>', $filter);
    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent -- no evasion.');

    $f = _filter_html('<A href="http://www.example.com/">text</a>', $filter);
    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- capital A.');

    $f = _filter_html("<a/href=\"http://www.example.com/\">text</a>", $filter);
    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- non whitespace character after tag name.');

    $f = _filter_html("<\0a\0 href=\"http://www.example.com/\">text</a>", $filter);
    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- some nulls.');

    $f = _filter_html('<a href="http://www.example.com/" rel="follow">text</a>', $filter);
    $this->assertNoNormalized($f, 'rel="follow"', 'Spam deterrent evasion -- with rel set - rel="follow" removed.');
    $this->assertNormalized($f, 'rel="nofollow"', 'Spam deterrent evasion -- with rel set - rel="nofollow" added.');
  }

  /**
   * Tests the loose, admin HTML filter.
   */
  function testFilterXSSAdmin() {
    // DRUPAL-SA-2008-044
    $f = filter_xss_admin('<object />');
    $this->assertNoNormalized($f, 'object', 'Admin HTML filter -- should not allow object tag.');

    $f = filter_xss_admin('<script />');
    $this->assertNoNormalized($f, 'script', 'Admin HTML filter -- should not allow script tag.');

    $f = filter_xss_admin('<style /><iframe /><frame /><frameset /><meta /><link /><embed /><applet /><param /><layer />');
    $this->assertEqual($f, '', 'Admin HTML filter -- should never allow some tags.');
  }

  /**
   * Tests the HTML escaping filter.
   *
   * check_plain() is not tested here.
   */
  function testHtmlEscapeFilter() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->callback = '_filter_html_escape';

    $tests = array(
      "   One. <!-- \"comment\" --> Two'.\n<p>Three.</p>\n    " => array(
        "One. &lt;!-- &quot;comment&quot; --&gt; Two&#039;.\n&lt;p&gt;Three.&lt;/p&gt;" => TRUE,
        '   One.' => FALSE,
        "</p>\n    " => FALSE,
      ),
    );
    $this->assertFilteredString($filter, $tests);
  }

  /**
   * Tests the URL filter.
   */
  function testUrlFilter() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->callback = '_filter_url';
    $filter->settings = array(
      'filter_url_length' => 496,
    );
    // @todo Possible categories:
    // - absolute, mail, partial
    // - characters/encoding, surrounding markup, security

    // Create an email that is too long.
    $long_email = str_repeat('a', 254) . '@example.com';
    $too_long_email = str_repeat('b', 255) . '@example.com';
    $email_with_plus_sign = 'one+two@example.com';


    // Filter selection/pattern matching.
    $tests = array(
      // HTTP URLs.
      '
http://example.com or www.example.com
' => array(
        '<a href="http://example.com">http://example.com</a>' => TRUE,
        '<a href="http://www.example.com">www.example.com</a>' => TRUE,
      ),
      // MAILTO URLs.
      '
person@example.com or mailto:person2@example.com or ' . $email_with_plus_sign . ' or ' . $long_email . ' but not ' . $too_long_email . '
' => array(
        '<a href="mailto:person@example.com">person@example.com</a>' => TRUE,
        '<a href="mailto:person2@example.com">mailto:person2@example.com</a>' => TRUE,
        '<a href="mailto:' . $long_email . '">' . $long_email . '</a>' => TRUE,
        '<a href="mailto:' . $too_long_email . '">' . $too_long_email . '</a>' => FALSE,
        '<a href="mailto:' . $email_with_plus_sign . '">' . $email_with_plus_sign . '</a>' => TRUE,
      ),
      // URI parts and special characters.
      '
http://trailingslash.com/ or www.trailingslash.com/
http://host.com/some/path?query=foo&bar[baz]=beer#fragment or www.host.com/some/path?query=foo&bar[baz]=beer#fragment
http://twitter.com/#!/example/status/22376963142324226
ftp://user:pass@ftp.example.com/~home/dir1
sftp://user@nonstandardport:222/dir
ssh://192.168.0.100/srv/git/backdrop.git
' => array(
        '<a href="http://trailingslash.com/">http://trailingslash.com/</a>' => TRUE,
        '<a href="http://www.trailingslash.com/">www.trailingslash.com/</a>' => TRUE,
        '<a href="http://host.com/some/path?query=foo&amp;bar[baz]=beer#fragment">http://host.com/some/path?query=foo&amp;bar[baz]=beer#fragment</a>' => TRUE,
        '<a href="http://www.host.com/some/path?query=foo&amp;bar[baz]=beer#fragment">www.host.com/some/path?query=foo&amp;bar[baz]=beer#fragment</a>' => TRUE,
        '<a href="http://twitter.com/#!/example/status/22376963142324226">http://twitter.com/#!/example/status/22376963142324226</a>' => TRUE,
        '<a href="ftp://user:pass@ftp.example.com/~home/dir1">ftp://user:pass@ftp.example.com/~home/dir1</a>' => TRUE,
        '<a href="sftp://user@nonstandardport:222/dir">sftp://user@nonstandardport:222/dir</a>' => TRUE,
        '<a href="ssh://192.168.0.100/srv/git/backdrop.git">ssh://192.168.0.100/srv/git/backdrop.git</a>' => TRUE,
      ),
      // Encoding.
      '
http://ampersand.com/?a=1&b=2
http://encoded.com/?a=1&amp;b=2
' => array(
        '<a href="http://ampersand.com/?a=1&amp;b=2">http://ampersand.com/?a=1&amp;b=2</a>' => TRUE,
        '<a href="http://encoded.com/?a=1&amp;b=2">http://encoded.com/?a=1&amp;b=2</a>' => TRUE,
      ),
      // Domain name length.
      '
www.ex.ex or www.example.example or www.toolongdomainexampledomainexampledomainexampledomainexampledomain or
me@me.tv
' => array(
        '<a href="http://www.ex.ex">www.ex.ex</a>' => TRUE,
        '<a href="http://www.example.example">www.example.example</a>' => TRUE,
        'http://www.toolong' => FALSE,
        '<a href="mailto:me@me.tv">me@me.tv</a>' => TRUE,
      ),
      // Absolute URL protocols.
      // The list to test is found in the beginning of _filter_url() at
      // $protocols = settings_get('filter_allowed_protocols'... (approx line 1325).
      '
https://example.com,
ftp://ftp.example.com,
news://example.net,
telnet://example,
irc://example.host,
ssh://odd.geek,
sftp://secure.host?,
webcal://calendar,
rtsp://127.0.0.1,
not foo://disallowed.com.
' => array(
        'href="https://example.com"' => TRUE,
        'href="ftp://ftp.example.com"' => TRUE,
        'href="news://example.net"' => TRUE,
        'href="telnet://example"' => TRUE,
        'href="irc://example.host"' => TRUE,
        'href="ssh://odd.geek"' => TRUE,
        'href="sftp://secure.host"' => TRUE,
        'href="webcal://calendar"' => TRUE,
        'href="rtsp://127.0.0.1"' => TRUE,
        'href="foo://disallowed.com"' => FALSE,
        'not foo://disallowed.com.' => TRUE,
      ),
    );
    $this->assertFilteredString($filter, $tests);

    // Surrounding text/punctuation.
    $tests = array(
      '
Partial URL with trailing period www.partial.com.
Email with trailing comma person@example.com,
Absolute URL with trailing question http://www.absolute.com?
Query string with trailing exclamation www.query.com/index.php?a=!
Partial URL with 3 trailing www.partial.periods...
Email with 3 trailing exclamations@example.com!!!
Absolute URL and query string with 2 different punctuation characters (http://www.example.com/q=abc).
' => array(
        'period <a href="http://www.partial.com">www.partial.com</a>.' => TRUE,
        'comma <a href="mailto:person@example.com">person@example.com</a>,' => TRUE,
        'question <a href="http://www.absolute.com">http://www.absolute.com</a>?' => TRUE,
        'exclamation <a href="http://www.query.com/index.php?a=">www.query.com/index.php?a=</a>!' => TRUE,
        'trailing <a href="http://www.partial.periods">www.partial.periods</a>...' => TRUE,
        'trailing <a href="mailto:exclamations@example.com">exclamations@example.com</a>!!!' => TRUE,
        'characters (<a href="http://www.example.com/q=abc">http://www.example.com/q=abc</a>).' => TRUE,
      ),
      '
(www.parenthesis.com/dir?a=1&b=2#a)
' => array(
        '(<a href="http://www.parenthesis.com/dir?a=1&amp;b=2#a">www.parenthesis.com/dir?a=1&amp;b=2#a</a>)' => TRUE,
      ),
    );
    $this->assertFilteredString($filter, $tests);

    // Surrounding markup.
    $tests = array(
      '
<p xmlns="www.namespace.com" />
<p xmlns="http://namespace.com">
An <a href="http://example.com" title="Read more at www.example.info...">anchor</a>.
</p>
' => array(
        '<p xmlns="www.namespace.com" />' => TRUE,
        '<p xmlns="http://namespace.com">' => TRUE,
        'href="http://www.namespace.com"' => FALSE,
        'href="http://namespace.com"' => FALSE,
        'An <a href="http://example.com" title="Read more at www.example.info...">anchor</a>.' => TRUE,
      ),
      '
Not <a href="foo">www.relative.com</a> or <a href="http://absolute.com">www.absolute.com</a>
but <strong>http://www.strong.net</strong> or <em>www.emphasis.info</em>
' => array(
        '<a href="foo">www.relative.com</a>' => TRUE,
        'href="http://www.relative.com"' => FALSE,
        '<a href="http://absolute.com">www.absolute.com</a>' => TRUE,
        '<strong><a href="http://www.strong.net">http://www.strong.net</a></strong>' => TRUE,
        '<em><a href="http://www.emphasis.info">www.emphasis.info</a></em>' => TRUE,
      ),
      '
Test <code>using www.example.com the code tag</code>.
' => array(
        'href' => FALSE,
        'http' => FALSE,
      ),
      '
Intro.
<blockquote>
Quoted text linking to www.example.com, written by person@example.com, originating from http://origin.example.com. <code>@see www.usage.example.com or <em>www.example.info</em> bla bla</code>.
</blockquote>

Outro.
' => array(
        'href="http://www.example.com"' => TRUE,
        'href="mailto:person@example.com"' => TRUE,
        'href="http://origin.example.com"' => TRUE,
        'http://www.usage.example.com' => FALSE,
        'http://www.example.info' => FALSE,
        'Intro.' => TRUE,
        'Outro.' => TRUE,
      ),
      '
Unknown tag <x>containing x and www.example.com</x>? And a tag <pooh>beginning with p and containing www.example.pooh with p?</pooh>
' => array(
        'href="http://www.example.com"' => TRUE,
        'href="http://www.example.pooh"' => TRUE,
      ),
      '
<p>Test &lt;br/&gt;: This is a www.example17.com example <strong>with</strong> various http://www.example18.com tags. *<br/>
 It is important www.example19.com to *<br/>test different URLs and http://www.example20.com in the same paragraph. *<br>
HTML www.example21.com soup by person@example22.com can literally http://www.example23.com contain *img*<img> anything. Just a www.example24.com with http://www.example25.com thrown in. www.example26.com from person@example27.com with extra http://www.example28.com.
' => array(
        'href="http://www.example17.com"' => TRUE,
        'href="http://www.example18.com"' => TRUE,
        'href="http://www.example19.com"' => TRUE,
        'href="http://www.example20.com"' => TRUE,
        'href="http://www.example21.com"' => TRUE,
        'href="mailto:person@example22.com"' => TRUE,
        'href="http://www.example23.com"' => TRUE,
        'href="http://www.example24.com"' => TRUE,
        'href="http://www.example25.com"' => TRUE,
        'href="http://www.example26.com"' => TRUE,
        'href="mailto:person@example27.com"' => TRUE,
        'href="http://www.example28.com"' => TRUE,
      ),
      '
<script>
<!--
  // @see www.example.com
  var exampleurl = "http://example.net";
-->
<!--//--><![CDATA[//><!--
  // @see www.example.com
  var exampleurl = "http://example.net";
//--><!]]>
</script>
' => array(
        'href="http://www.example.com"' => FALSE,
        'href="http://example.net"' => FALSE,
      ),
      '
<style>body {
  background: url(http://example.com/pixel.gif);
}</style>
' => array(
        'href' => FALSE,
      ),
      '
<!-- Skip any URLs like www.example.com in comments -->
' => array(
        'href' => FALSE,
      ),
      '
<!-- Skip any URLs like
www.example.com with a newline in comments -->
' => array(
        'href' => FALSE,
      ),
      '
<!-- Skip any URLs like www.comment.com in comments. <p>Also ignore http://commented.out/markup.</p> -->
' => array(
        'href' => FALSE,
      ),
      '
<dl>
<dt>www.example.com</dt>
<dd>http://example.com</dd>
<dd>person@example.com</dd>
<dt>Check www.example.net</dt>
<dd>Some text around http://www.example.info by person@example.info?</dd>
</dl>
' => array(
        'href="http://www.example.com"' => TRUE,
        'href="http://example.com"' => TRUE,
        'href="mailto:person@example.com"' => TRUE,
        'href="http://www.example.net"' => TRUE,
        'href="http://www.example.info"' => TRUE,
        'href="mailto:person@example.info"' => TRUE,
      ),
      '
<div>www.div.com</div>
<ul>
<li>http://listitem.com</li>
<li class="odd">www.class.listitem.com</li>
</ul>
' => array(
        '<div><a href="http://www.div.com">www.div.com</a></div>' => TRUE,
        '<li><a href="http://listitem.com">http://listitem.com</a></li>' => TRUE,
        '<li class="odd"><a href="http://www.class.listitem.com">www.class.listitem.com</a></li>' => TRUE,
      ),
      // 'nolink' class.
      '
<p class="nolink">www.no-example.com</p>
<p class="no-link">www.example.com</p>
<span class="link nolink button">www.button-me.com</span>
<div id="divitis" class="nolink" alt="Alt text">www.divitis.com</div>
<p class="nolink">me@no-example.com</p>
<p class="nolink2">me@example.com</p>
<span class="link nolink button">you@button-me.com</span>
<div id="divitis" class="nolink" alt="Alt text">us@divitis.com</div>
' => array(
        '<p class="nolink"><a href="http://www.no-example.com">www.no-example.com</a></p>' => FALSE,
        '<p class="no-link"><a href="http://www.example.com">www.example.com</a></p>' => TRUE,
        '<span class="link nolink button"><a href="www.button-me.com">www.button-me.com</a></span>' => FALSE,
        '<div id="divitis" class="nolink" alt="Alt text"><a href="http://www.divitis.com">www.divitis.com</a></div>' => FALSE,
        '<p class="nolink"><a href="mailto:me@no-example.com">me@no-example.com</a></p>' => FALSE,
        '<p class="nolink2"><a href="mailto:me@example.com">me@example.com</a></p>' => TRUE,
        '<span class="link nolink button"><a href="mailto:you@button-me.com">you@button-me.com</a></span>' => FALSE,
        '<div id="divitis" class="nolink" alt="Alt text"><a href="mailto:us@divitis.com">us@divitis.com</a></div>' => FALSE,
      ),
    );
    $this->assertFilteredString($filter, $tests);

    // URL trimming.
    $filter->settings['filter_url_length'] = 20;
    $tests = array(
      'www.trimmed.com/d/ff.ext?a=1&b=2#a1' => array(
        '<a href="http://www.trimmed.com/d/ff.ext?a=1&amp;b=2#a1">www.trimmed.com/d/ff...</a>' => TRUE,
      ),
    );
    $this->assertFilteredString($filter, $tests);
  }

  /**
   * Asserts multiple filter output expectations for multiple input strings.
   *
   * @param $filter
   *   A input filter object.
   * @param $tests
   *   An associative array, whereas each key is an arbitrary input string and
   *   each value is again an associative array whose keys are filter output
   *   strings and whose values are Booleans indicating whether the output is
   *   expected or not.
   *
   * For example:
   * @code
   * $tests = array(
   *   'Input string' => array(
   *     '<p>Input string</p>' => TRUE,
   *     'Input string<br' => FALSE,
   *   ),
   * );
   * @endcode
   * This means that after passing 'Input string' through the given filter, we
   * should find '<p>Input string</p>' in the output, but not 'Input string<br'.
   */
  function assertFilteredString($filter, $tests) {
    foreach ($tests as $source => $tasks) {
      $function = $filter->callback;
      $result = $function($source, $filter);
      foreach ($tasks as $value => $is_expected) {
        // Not using assertIdentical, since combination with strpos() is hard to grok.
        if ($is_expected) {
          $success = $this->assertTrue(strpos($result, $value) !== FALSE, format_string('@source: @value found.', array(
            '@source' => var_export($source, TRUE),
            '@value' => var_export($value, TRUE),
          )));
        }
        else {
          $success = $this->assertTrue(strpos($result, $value) === FALSE, format_string('@source: @value not found.', array(
            '@source' => var_export($source, TRUE),
            '@value' => var_export($value, TRUE),
          )));
        }
        if (!$success) {
          $this->verbose('Source:<pre>' . check_plain(var_export($source, TRUE)) . '</pre>'
            . '<hr />Result:<pre>' . check_plain(var_export($result, TRUE)) . '</pre>'
            . '<hr />' . ($is_expected ? 'Expected:' : 'Not expected:')
            . '<pre>' . check_plain(var_export($value, TRUE)) . '</pre>'
          );
        }
      }
    }
  }

  /**
   * Tests URL filter on longer content.
   *
   * Filters based on regular expressions should also be tested with a more
   * complex content than just isolated test lines.
   * The most common errors are:
   * - accidental '*' (greedy) match instead of '*?' (minimal) match.
   * - only matching first occurrence instead of all.
   * - newlines not matching '.*'.
   *
   * This test covers:
   * - Document with multiple newlines and paragraphs (two newlines).
   * - Mix of several HTML tags, invalid non-HTML tags, tags to ignore and HTML
   *   comments.
   * - Empty HTML tags (BR, IMG).
   * - Mix of absolute and partial URLs, and email addresses in one content.
   */
  function testUrlFilterContent() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->settings = array(
      'filter_url_length' => 496,
    );
    $path = backdrop_get_path('module', 'filter') . '/tests';

    $input = file_get_contents($path . '/filter.url-input.txt');
    $expected = file_get_contents($path . '/filter.url-output.txt');
    $result = _filter_url($input, $filter);
    $this->assertIdentical($result, $expected, 'Complex HTML document was correctly processed.');
  }

  /**
   * Tests the Image alignment filter (data-align).
   */
  function testImageAlignFilter() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->callback = '_filter_image_align';

    $input = <<<EOF
<p><img src="foo.png" width="100" height="100" data-align="right" /></p>
<p><img src="foo.png" width="100" height="100" data-align="left" /></p>
<p><img src="foo.png" width="100" height="100" data-align="center" /></p>
<p><img src="foo.png" width="100" height="100" data-align="bottom" /></p>

<p><img src="foo.png" class="foo" data-align="right" /></p>

<blockquote data-align="left">
  A quote
</blockquote>

<p class="foo" data-align="center">
  Centered paragraph.
</p>
EOF;

    $tests = array(
      $input => array(
        '<img src="foo.png" width="100" height="100" class="align-right" />' => TRUE,
        '<img src="foo.png" width="100" height="100" class="align-left" />' => TRUE,
        '<img src="foo.png" width="100" height="100" class="align-center" />' => TRUE,
        // An unknown alignment (bottom) should be removed.
        '<img src="foo.png" width="100" height="100" />' => TRUE,
        '<img src="foo.png" width="100" height="100" class="align-bottom" />' => FALSE,

        // The align class should be added to existing classes.
        '<img src="foo.png" class="foo align-right" />' => TRUE,

        // Align class also works on other elements, despite the filter name.
        '<blockquote class="align-left">' => TRUE,
        '<p class="foo align-center">' => TRUE,

        // Ensure the temporarily wrapped body tag is stripped before output.
        '<body>' => FALSE,
      ),
    );
    $this->assertFilteredString($filter, $tests);
  }

  /**
   * Tests the Image caption filter (data-caption).
   */
  function testImageAlignCaption() {
    // Set up dummy filter object.
    $filter = new stdClass();
    $filter->callback = '_filter_image_caption';

    $input = <<<EOF
<img data-caption="Simple caption" src="foo.png" />
<img data-caption="The caption with a &lt;a href=&quot;/foo&quot;&gt; link&lt;/a&gt;.&lt;strong&gt; Bold tag.&lt;/strong&gt;" src="foo.png" />
<img data-caption="The caption with a &lt;div&gt;not allowed tag&lt;/div&gt;." src="foo.png" />
EOF;

    $tests = array(
      $input => array(
        '<figure class="caption caption-img"><img src="foo.png" /><figcaption>Simple caption</figcaption></figure>' => TRUE,
        '<figure class="caption caption-img"><img src="foo.png" /><figcaption>The caption with a <a href="/foo"> link</a>.<strong> Bold tag.</strong></figcaption></figure>' => TRUE,
        '<figure class="caption caption-img"><img src="foo.png" /><figcaption>The caption with a not allowed tag.</figcaption></figure>' => TRUE,
        '<figure class="caption caption-img"><img src="foo.png" /><figcaption>The caption with a <div>not allowed tag</div>.</figcaption></figure>' => FALSE,
        // Ensure the temporarily wrapped body tag is stripped before output.
        '<body>' => FALSE,
      ),
    );
    $this->assertFilteredString($filter, $tests);
  }

  /**
   * Tests the HTML corrector filter.
   *
   * @todo This test could really use some validity checking function.
   */
  function testHtmlCorrectorFilter() {
    // Tag closing.
    $f = _filter_htmlcorrector('<p>text');
    $this->assertEqual($f, '<p>text</p>', 'HTML corrector -- tag closing at the end of input.');

    $f = _filter_htmlcorrector('<p>text<p><p>text');
    $this->assertEqual($f, '<p>text</p><p></p><p>text</p>', 'HTML corrector -- tag closing.');

    $f = _filter_htmlcorrector("<ul><li>e1<li>e2");
    $this->assertEqual($f, "<ul><li>e1</li><li>e2</li></ul>", 'HTML corrector -- unclosed list tags.');

    $f = _filter_htmlcorrector('<div id="d">content');
    $this->assertEqual($f, '<div id="d">content</div>', 'HTML corrector -- unclosed tag with attribute.');

    // XHTML slash for empty elements.
    $f = _filter_htmlcorrector('<hr><br>');
    $this->assertEqual($f, '<hr /><br />', 'HTML corrector -- XHTML closing slash.');

    $f = _filter_htmlcorrector('<P>test</P>');
    $this->assertEqual($f, '<p>test</p>', 'HTML corrector -- Convert uppercased tags to proper lowercased ones.');

    $f = _filter_htmlcorrector('<P>test</p>');
    $this->assertEqual($f, '<p>test</p>', 'HTML corrector -- Convert uppercased tags to proper lowercased ones.');

    $f = _filter_htmlcorrector('test<hr />');
    $this->assertEqual($f, 'test<hr />', 'HTML corrector -- Let proper XHTML pass through.');

    $f = _filter_htmlcorrector('test<hr/>');
    $this->assertEqual($f, 'test<hr />', 'HTML corrector -- Let proper XHTML pass through, but ensure there is a single space before the closing slash.');

    $f = _filter_htmlcorrector('test<hr    />');
    $this->assertEqual($f, 'test<hr />', 'HTML corrector -- Let proper XHTML pass through, but ensure there are not too many spaces before the closing slash.');

    $f = _filter_htmlcorrector('<span class="test" />');
    $this->assertEqual($f, '<span class="test"></span>', 'HTML corrector -- Convert XHTML that is properly formed but that would not be compatible with typical HTML user agents.');

    $f = _filter_htmlcorrector('test1<br class="test">test2');
    $this->assertEqual($f, 'test1<br class="test" />test2', 'HTML corrector -- Automatically close single tags.');

    $f = _filter_htmlcorrector('line1<hr>line2');
    $this->assertEqual($f, 'line1<hr />line2', 'HTML corrector -- Automatically close single tags.');

    $f = _filter_htmlcorrector('line1<HR>line2');
    $this->assertEqual($f, 'line1<hr />line2', 'HTML corrector -- Automatically close single tags.');

    $f = _filter_htmlcorrector('<img src="http://example.com/test.jpg">test</img>');
    $this->assertEqual($f, '<img src="http://example.com/test.jpg" />test', 'HTML corrector -- Automatically close single tags.');

    $f = _filter_htmlcorrector('<br></br>');
    $this->assertEqual($f, '<br />', "HTML corrector -- Transform empty tags to a single closed tag if the tag's content model is EMPTY.");

    $f = _filter_htmlcorrector('<div></div>');
    $this->assertEqual($f, '<div></div>', "HTML corrector -- Do not transform empty tags to a single closed tag if the tag's content model is not EMPTY.");

    $f = _filter_htmlcorrector('<p>line1<br/><hr/>line2</p>');
    $this->assertEqual($f, '<p>line1<br /></p><hr />line2', 'HTML corrector -- Move non-inline elements outside of inline containers.');

    $f = _filter_htmlcorrector('<p>line1<div>line2</div></p>');
    $this->assertEqual($f, '<p>line1</p><div>line2</div>', 'HTML corrector -- Move non-inline elements outside of inline containers.');

    $f = _filter_htmlcorrector('<p>test<p>test</p>\n');
    $this->assertEqual($f, '<p>test</p><p>test</p>\n', 'HTML corrector -- Auto-close improperly nested tags.');

    $f = _filter_htmlcorrector('<p>Line1<br><STRONG>bold stuff</b>');
    $this->assertEqual($f, '<p>Line1<br /><strong>bold stuff</strong></p>', 'HTML corrector -- Properly close unclosed tags, and remove useless closing tags.');

    $f = _filter_htmlcorrector('test <!-- this is a comment -->');
    $this->assertEqual($f, 'test <!-- this is a comment -->', 'HTML corrector -- Do not touch HTML comments.');

    $f = _filter_htmlcorrector('test <!--this is a comment-->');
    $this->assertEqual($f, 'test <!--this is a comment-->', 'HTML corrector -- Do not touch HTML comments.');

    $f = _filter_htmlcorrector('test <!-- comment <p>another
    <strong>multiple</strong> line
    comment</p> -->');
    $this->assertEqual($f, 'test <!-- comment <p>another
    <strong>multiple</strong> line
    comment</p> -->', 'HTML corrector -- Do not touch HTML comments.');

    $f = _filter_htmlcorrector('test <!-- comment <p>another comment</p> -->');
    $this->assertEqual($f, 'test <!-- comment <p>another comment</p> -->', 'HTML corrector -- Do not touch HTML comments.');

    $f = _filter_htmlcorrector('test <!--break-->');
    $this->assertEqual($f, 'test <!--break-->', 'HTML corrector -- Do not touch HTML comments.');

    $f = _filter_htmlcorrector('<p>test\n</p>\n');
    $this->assertEqual($f, '<p>test\n</p>\n', 'HTML corrector -- New-lines are accepted and kept as-is.');

    // cspell:disable
    $f = _filter_htmlcorrector('<p>دروبال');
    $this->assertEqual($f, '<p>دروبال</p>', 'HTML corrector -- Encoding is correctly kept.');
    // cspell:enable

    $f = _filter_htmlcorrector('<script type="text/javascript">alert("test")</script>');
    $this->assertEqual($f, '<script type="text/javascript">
<!--//--><![CDATA[// ><!--
alert("test")
//--><!]]>
</script>', 'HTML corrector -- CDATA added to script element');

    $f = _filter_htmlcorrector('<p><script type="text/javascript">alert("test")</script></p>');
    $this->assertEqual($f, '<p><script type="text/javascript">
<!--//--><![CDATA[// ><!--
alert("test")
//--><!]]>
</script></p>', 'HTML corrector -- CDATA added to a nested script element');

    $f = _filter_htmlcorrector('<p><style> /* Styling */ body {color:red}</style></p>');
    $this->assertEqual($f, '<p><style>
<!--/*--><![CDATA[/* ><!--*/
 /* Styling */ body {color:red}
/*--><!]]>*/
</style></p>', 'HTML corrector -- CDATA added to a style element.');

    $filtered_data = _filter_htmlcorrector('<p><style>
/*<![CDATA[*/
/* Styling */
body {color:red}
/*]]>*/
</style></p>');
    $this->assertEqual($filtered_data, '<p><style>
<!--/*--><![CDATA[/* ><!--*/

/*<![CDATA[*/
/* Styling */
body {color:red}
/*]]]]><![CDATA[>*/

/*--><!]]>*/
</style></p>',
      format_string('HTML corrector -- Existing cdata section @pattern_name properly escaped', array('@pattern_name' => '/*<![CDATA[*/'))
    );

    $filtered_data = _filter_htmlcorrector('<p><style>
  <!--/*--><![CDATA[/* ><!--*/
  /* Styling */
  body {color:red}
  /*--><!]]>*/
</style></p>');
    $this->assertEqual($filtered_data, '<p><style>
<!--/*--><![CDATA[/* ><!--*/

  <!--/*--><![CDATA[/* ><!--*/
  /* Styling */
  body {color:red}
  /*--><!]]]]><![CDATA[>*/

/*--><!]]>*/
</style></p>',
      format_string('HTML corrector -- Existing cdata section @pattern_name properly escaped', array('@pattern_name' => '<!--/*--><![CDATA[/* ><!--*/'))
    );

    $filtered_data = _filter_htmlcorrector('<p><script type="text/javascript">
<!--//--><![CDATA[// ><!--
  alert("test");
//--><!]]>
</script></p>');
    $this->assertEqual($filtered_data, '<p><script type="text/javascript">
<!--//--><![CDATA[// ><!--

<!--//--><![CDATA[// ><!--
  alert("test");
//--><!]]]]><![CDATA[>

//--><!]]>
</script></p>',
      format_string('HTML corrector -- Existing cdata section @pattern_name properly escaped', array('@pattern_name' => '<!--//--><![CDATA[// ><!--'))
    );

    $filtered_data = _filter_htmlcorrector('<p><script type="text/javascript">
// <![CDATA[
  alert("test");
// ]]>
</script></p>');
    $this->assertEqual($filtered_data, '<p><script type="text/javascript">
<!--//--><![CDATA[// ><!--

// <![CDATA[
  alert("test");
// ]]]]><![CDATA[>

//--><!]]>
</script></p>',
      format_string('HTML corrector -- Existing cdata section @pattern_name properly escaped', array('@pattern_name' => '// <![CDATA['))
    );

  }

  /**
   * Asserts that a text transformed to lowercase with HTML entities decoded does contains a given string.
   *
   * Otherwise fails the test with a given message, similar to all the
   * SimpleTest assert* functions.
   *
   * Note that this does not remove nulls, new lines and other characters that
   * could be used to obscure a tag or an attribute name.
   *
   * @param $haystack
   *   Text to look in.
   * @param $needle
   *   Lowercase, plain text to look for.
   * @param $message
   *   (optional) Message to display if failed. Defaults to an empty string.
   * @param $group
   *   (optional) The group this message belongs to. Defaults to 'Other'.
   * @return
   *   TRUE on pass, FALSE on fail.
   */
  function assertNormalized($haystack, $needle, $message = '', $group = 'Other') {
    return $this->assertTrue(strpos(strtolower(decode_entities($haystack)), $needle) !== FALSE, $message, $group);
  }

  /**
   * Asserts that text transformed to lowercase with HTML entities decoded does not contain a given string.
   *
   * Otherwise fails the test with a given message, similar to all the
   * SimpleTest assert* functions.
   *
   * Note that this does not remove nulls, new lines, and other character that
   * could be used to obscure a tag or an attribute name.
   *
   * @param $haystack
   *   Text to look in.
   * @param $needle
   *   Lowercase, plain text to look for.
   * @param $message
   *   (optional) Message to display if failed. Defaults to an empty string.
   * @param $group
   *   (optional) The group this message belongs to. Defaults to 'Other'.
   * @return
   *   TRUE on pass, FALSE on fail.
   */
  function assertNoNormalized($haystack, $needle, $message = '', $group = 'Other') {
    return $this->assertTrue(strpos(strtolower(decode_entities($haystack)), $needle) === FALSE, $message, $group);
  }
}

/**
 * Tests for Filter's hook invocations.
 */
class FilterHooksTestCase extends BackdropWebTestCase {
  function setUp() {
    parent::setUp('block', 'filter_test');
    $admin_user = $this->backdropCreateUser(array('administer filters', 'administer blocks'));
    $this->backdropLogin($admin_user);
  }

  /**
   * Tests hooks on format management.
   *
   * Tests that hooks run correctly on creating, editing, and deleting a text
   * format.
   */
  function testFilterHooks() {
    // Add a text format.
    $name = $this->randomName();
    $edit = array();
    $edit['format'] = backdrop_strtolower($this->randomName());
    $edit['name'] = $name;
    $edit['roles[anonymous]'] = 1;
    $this->backdropPost('admin/config/content/formats/add', $edit, t('Save configuration'));
    $this->assertRaw(t('Added text format %format.', array('%format' => $name)), t('New format created.'));
    $this->assertText('hook_filter_format_insert invoked.', t('hook_filter_format_insert was invoked.'));

    $format_id = $edit['format'];

    // Update text format.
    $edit = array();
    $edit['roles[authenticated]'] = 1;
    $this->backdropPost('admin/config/content/formats/' . $format_id, $edit, t('Save configuration'));
    $this->assertRaw(t('Updated text format %format.', array('%format' => $name)), 'Format successfully updated.');
    $this->assertText('hook_filter_format_update invoked.', 'hook_filter_format_update() was invoked.');

    // Add a new custom block.
    $custom_block = array();
    $custom_block['info'] = $this->randomName(8);
    $custom_block['delta'] = strtolower($this->randomName(8));
    $custom_block['title'] = $this->randomName(8);
    $custom_block['body[value]'] = $this->randomName(32);
    // Use the format created.
    $custom_block['body[format]'] = $format_id;
    $this->backdropPost('admin/structure/block/add', $custom_block, t('Save block'));
    $this->assertText(t('The block has been created.'), 'New block successfully created.');

    // Check to see if the custom block was created by checking that it has a configuration file.
    $custom_block = config_get('block.custom.'.$custom_block['delta']);
    $this->assertNotNull($custom_block['delta'], 'New block found in configuration.');

    // Disable the text format.
    $this->backdropPost('admin/config/content/formats/' . $format_id . '/disable', array(), t('Disable'));
    $this->assertRaw(t('Disabled text format %format.', array('%format' => $name)), 'Format successfully disabled.');
    $this->assertText('hook_filter_format_disable invoked.', 'hook_filter_format_disable() was invoked.');
  }
}

/**
 * Tests filter settings.
 */
class FilterSettingsTestCase extends BackdropWebTestCase {
  /**
   * The installation profile to use with this test class.
   *
   * @var string
   */
  protected $profile = 'testing';

  /**
   * Tests explicit and implicit default settings for filters.
   */
  function testFilterDefaults() {
    $filter_info = filter_filter_info();
    $filters = array_fill_keys(array_keys($filter_info), array());

    // Create text format using filter default settings.
    $filter_defaults_format = (object) array(
      'format' => 'filter_defaults',
      'name' => 'Filter defaults',
      'filters' => $filters,
    );
    filter_format_save($filter_defaults_format);

    // Verify that default weights defined in hook_filter_info() were applied.
    $saved_settings = array();
    foreach ($filter_defaults_format->filters as $name => $filter) {
      $expected_weight = (isset($filter_info[$name]['weight']) ? $filter_info[$name]['weight'] : 0);
      $this->assertEqual($filter->weight, $expected_weight, format_string('@name filter weight %saved equals %default', array(
        '@name' => $name,
        '%saved' => $filter->weight,
        '%default' => $expected_weight,
      )));
      $saved_settings[$name]['weight'] = $expected_weight;
    }

    // Re-save the text format.
    filter_format_save($filter_defaults_format);
    // Reload it from scratch.
    filter_formats_reset();
    $filter_defaults_format = filter_format_load($filter_defaults_format->format);

    // Verify that saved filter settings have not been changed.
    foreach ($filter_defaults_format->filters as $name => $filter) {
      $this->assertEqual($filter->weight, $saved_settings[$name]['weight'], format_string('@name filter weight %saved equals %previous', array(
        '@name' => $name,
        '%saved' => $filter->weight,
        '%previous' => $saved_settings[$name]['weight'],
      )));
    }
  }
}

/**
 * Tests for filter.module's node/entity hooks to track file usage.
 */
class FilterFileUsageTest extends BackdropWebTestCase {
  /**
   * Tests file usages are tracked in creating, updating, and deleting content.
   */
  function testFilterEntityHooks() {
    $image = entity_create('file', array());
    $image->uri = 'core/misc/favicon.ico';
    $image->filename = 'favicon.ico';
    $image->save();
    $this->assertIdentical(array(), file_usage_list($image), 'The image has zero usages.');

    // Test filter_entity_insert(): increment.
    $node = new Node(array(
      'type' => 'page',
      'title' => 'test',
      'uid' => 0,
      'body' => array(
        'und' => array(
          0 => array(
            'value' => '<p>Hello, world!</p><img src="awesome-llama.jpg" data-file-id="' . $image->fid . '" />',
            'format' => 'filtered_html',
          ),
        ),
      ),
      'log' => 'First revision.',
    ));
    $node->save();
    $nid = $node->nid;
    $this->assertIdentical(array('filter' => array('node' => array($nid => '1'))), file_usage_list($image), 'The image has 1 usage.');

    // Test filter_entity_update(): increment, twice, by creating new revisions.
    $node->vid = NULL;
    $node->log = 'Second revision.';
    $node->save();
    $second_revision_id = $node->vid;
    $node->vid = NULL;
    $node->log = 'Third revision.';
    $node->save();
    $this->assertIdentical(array('filter' => array('node' => array($nid => '3'))), file_usage_list($image), 'The image has 3 usages.');

    // Test hook_entity_update(): decrement, by modifying the last revision:
    // remove the data- attribute from the body field.
    $original_value = $node->body[LANGUAGE_NONE][0]['value'];
    $new_value = str_replace('data-file-id', 'data-file-id-modified', $original_value);
    $node->body[LANGUAGE_NONE][0]['value'] = $new_value;
    $node->save();
    $this->assertIdentical(array('filter' => array('node' => array($nid => '2'))), file_usage_list($image), 'The image has 2 usages.');

    // Test hook_entity_update(): increment, by modifying the last revision:
    // read the data- attribute to the body field.
    $node->body[LANGUAGE_NONE][0]['value'] = $original_value;
    $node->save();
    $this->assertIdentical(array('filter' => array('node' => array($nid => '3'))), file_usage_list($image), 'The image has 3 usages.');

    // Test filter_node_revision_delete(): decrement, by deleting a revision.
    node_revision_delete($second_revision_id);
    $this->assertIdentical(array('filter' => array('node' => array($nid => '2'))), file_usage_list($image), 'The image has 2 usages.');

    // Test filter_entity_delete().
    $node->delete();
    $this->assertIdentical(array(), file_usage_list($image), 'The image has zero usages again.');
  }
}

/**
 * Tests DOMDocument Serialization.
 */
class FilterDOMSerializeTestCase extends BackdropWebTestCase {
  /**
   * Tests empty DOMDocument object.
   */
  function testFilterEmptyDOMSerialization() {
    $document = new DOMDocument();
    $result = filter_dom_serialize($document);
    $this->assertEqual('', $result);
  }
}

/**
 * Tests access to editors and their associated dialogs.
 */
class FilterEditorAccessTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  function setUp() {
    parent::setUp(array('file'));

    $filtered_html_format = array(
      'format' => 'filtered_html',
      'name' => 'Basic',
      'weight' => 0,
      'editor' => 'ckeditor',
      'filters' => array(),
    );
    $filtered_html_format = (object) $filtered_html_format;
    filter_format_save($filtered_html_format);

    $filtered_html_permission = filter_permission_name($filtered_html_format);
    user_role_grant_permissions(BACKDROP_ANONYMOUS_ROLE, array($filtered_html_permission));
    user_role_grant_permissions(BACKDROP_AUTHENTICATED_ROLE, array($filtered_html_permission));
  }

  /**
   * Checks access to editor dialogs for adding images and links.
   */
  function testDialogAccess() {
    // Check that the dialog for filtered HTML is not directly accessible.
    $this->backdropGet('editor/dialog/image/filtered_html');
    $this->assertResponse(403, 'Access denied on image dialog without token.');

    // Generate a valid token.
    $format = filter_format_load('filtered_html');
    $anonymous = new AnonymousUser();
    $dialog_token = filter_editor_dialog_token($format, 'image', $anonymous, 'some-path');
    $options = array(
      'query' => array(
        'token' => $dialog_token,
        'calling_path' => 'some-path',
      ),
    );

    $this->backdropGet('editor/dialog/image/filtered_html', $options);
    $this->assertResponse(200, 'Access granted on image dialog with token.');

    $this->assertNoField('files[fid]', 'File upload field not found when uploads are disabled.');

    $format->editor_settings['image_upload'] = array(
      'status' => 1,
      'scheme' => 'public',
    );
    filter_format_save($format);

    $this->backdropGet('editor/dialog/image/filtered_html', $options);
    $this->assertNoField('files[fid]', 'File upload field not found when uploads are enabled but user missing upload permission.');

    user_role_grant_permissions(BACKDROP_ANONYMOUS_ROLE, array('upload editor images'));
    $this->backdropGet('editor/dialog/image/filtered_html', $options);
    $this->assertField('files[fid]', 'File upload field found when uploads are enabled and user has upload permission.');

    // Revoke access to the format and check that access is denied.
    $filtered_html_permission = filter_permission_name($format);
    user_role_revoke_permissions(BACKDROP_ANONYMOUS_ROLE, array($filtered_html_permission));
    $this->backdropGet('editor/dialog/image/filtered_html', $options);
    $this->assertResponse(403, 'Access denied on image dialog when access to the format is not allowed.');
  }
}