TYPO3 Core

/**

* @test

*/

public function checkAttackHexEncodedCharacter() {

$testString = '<a href="j&#x61;vascript:alert(123);">click</a>';

$expectedString = '<a href="ja<x>vascript:alert(123);">click</a>';

$actualString = RemoveXSS::process($testString);

$this->assertEquals($expectedString, $actualString);

}

/**

* @test

*/

public function checkAttackNestedHexEncodedCharacter() {

$testString = '<a href="j&#x6&#x31;;vascript:alert(123);">click</a>';

$expectedString = '<a href="ja<x>vascript:alert(123);">click</a>';

$actualString = RemoveXSS::process($testString);

$this->assertEquals($expectedString, $actualString);

}

/**

* @test

*/

public function checkAttackUnicodeNumericalEncodedCharacter() {

$testString = '<a href="j&#65;vascript:alert(123);">click</a>';

$expectedString = '<a href="ja<x>vascript:alert(123);">click</a>';

$actualString = RemoveXSS::process($testString);

$this->assertEquals($expectedString, $actualString);

}

/**

* @test

*/

public function checkAttackNestedUnicodeNumericalEncodedCharacter() {

$testString = '<a href="j&#6&#53;;vascript:alert(123);">click</a>';

$expectedString = '<a href="ja<x>vascript:alert(123);">click</a>';

$actualString = RemoveXSS::process($testString);

$this->assertEquals($expectedString, $actualString);

}