diff --git a/test/MustacheInjectionTest.php b/test/MustacheInjectionTest.php new file mode 100644 index 0000000..de74943 --- /dev/null +++ b/test/MustacheInjectionTest.php @@ -0,0 +1,127 @@ + '{{ b }}', + 'b' => 'FAIL' + ); + $template = '{{ a }}'; + $output = '{{ b }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data)); + } + + public function testUnescapedInterpolationInjection() { + $data = array( + 'a' => '{{ b }}', + 'b' => 'FAIL' + ); + $template = '{{{ a }}}'; + $output = '{{ b }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data)); + } + + + // sections + + public function testSectionInjection() { + $data = array( + 'a' => true, + 'b' => '{{ c }}', + 'c' => 'FAIL' + ); + $template = '{{# a }}{{ b }}{{/ a }}'; + $output = '{{ c }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data)); + } + + public function testUnescapedSectionInjection() { + $data = array( + 'a' => true, + 'b' => '{{ c }}', + 'c' => 'FAIL' + ); + $template = '{{# a }}{{{ b }}}{{/ a }}'; + $output = '{{ c }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data)); + } + + + // partials + + public function testPartialInjection() { + $data = array( + 'a' => '{{ b }}', + 'b' => 'FAIL' + ); + $template = '{{> partial }}'; + $partials = array( + 'partial' => '{{ a }}', + ); + $output = '{{ b }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data, $partials)); + } + + public function testPartialUnescapedInjection() { + $data = array( + 'a' => '{{ b }}', + 'b' => 'FAIL' + ); + $template = '{{> partial }}'; + $partials = array( + 'partial' => '{{{ a }}}', + ); + $output = '{{ b }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data, $partials)); + } + + + // lambdas + + public function testLambdaInterpolationInjection() { + $data = array( + 'a' => array($this, 'interpolationLambda'), + 'b' => '{{ c }}', + 'c' => 'FAIL' + ); + $template = '{{ a }}'; + $output = '{{ c }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data)); + } + + public function interpolationLambda() { + return '{{ b }}'; + } + + public function testLambdaSectionInjection() { + $data = array( + 'a' => array($this, 'sectionLambda'), + 'b' => '{{ c }}', + 'c' => 'FAIL' + ); + $template = '{{# a }}b{{/ a }}'; + $output = '{{ c }}'; + $m = new Mustache(); + $this->assertEquals($output, $m->render($template, $data)); + } + + public function sectionLambda($content) { + return '{{ ' . $content . ' }}'; + } + +} \ No newline at end of file