From 28e27ac837e9bc333b1ffe2cc1cd6be10c01bb3e Mon Sep 17 00:00:00 2001
From: Marina Glancy <marina@moodle.com>
Date: Tue, 16 Aug 2016 13:44:53 +0800
Subject: [PATCH] MDL-55581 htmlpurifier: allow track tag in videos and audios

---
 lib/tests/htmlpurifier_test.php | 83 ++++++++++++++++++++++++---------
 lib/weblib.php                  | 14 ++++--
 2 files changed, 71 insertions(+), 26 deletions(-)

diff --git a/lib/tests/htmlpurifier_test.php b/lib/tests/htmlpurifier_test.php
index 31e3e53c46a..e2924af2968 100644
--- a/lib/tests/htmlpurifier_test.php
+++ b/lib/tests/htmlpurifier_test.php
@@ -327,7 +327,7 @@ class core_htmlpurifier_testcase extends basic_testcase {
      * @param string $expected expected result
      */
     public function test_media_tags($mediatag, $expected) {
-        $actual = format_text($mediatag, FORMAT_MOODLE, ['filter' => false, 'noclean' => true]);
+        $actual = format_text($mediatag, FORMAT_MOODLE, ['filter' => false]);
         $this->assertEquals($expected, $actual);
     }
 
@@ -353,8 +353,8 @@ class core_htmlpurifier_testcase extends basic_testcase {
         $videoattrs = [
             'crossorigin="anonymous"', 'crossorigin="use-credentials"',
             'poster="https://upload.wikimedia.org/wikipedia/en/1/14/Space_jam.jpg"',
-            'preload=""', 'autoplay=""', 'playsinline=""', 'loop=""', 'muted=""',
-            'controls=""', 'width="420px"', 'height="69px"'
+            'preload="auto"', 'autoplay=""', 'playsinline=""', 'loop=""', 'muted=""',
+            'controls=""', 'width="420"', 'height="69"'
         ];
         return $generatetestcases('Plain audio', $audioattrs + ['src="http://example.com/jam.wav"'], [
                 '<audio %1$s>Looks like you can\'t slam the jams.</audio>',
@@ -363,7 +363,7 @@ class core_htmlpurifier_testcase extends basic_testcase {
                 '<audio %1$s><source src="http://example.com/getup.wav">No tasty jams for you.</audio>',
                 '<div class="text_to_html">' .
                     '<audio %1$s>' .
-                        '<source src="http://example.com/getup.wav">' .
+                        '<source src="http://example.com/getup.wav" />' .
                         'No tasty jams for you.' .
                     '</audio>' .
                 '</div>'
@@ -375,21 +375,46 @@ class core_htmlpurifier_testcase extends basic_testcase {
                     'No tasty jams for you.' .
                 '</audio>',
                 '<div class="text_to_html">' .
-                     '<audio %1$s>' .
-                        '<source src="http://example.com/getup.wav" type="audio/wav">' .
-                        '<source src="http://example.com/getup.mp3" type="audio/mpeg">' .
-                        '<source src="http://example.com/getup.ogg" type="audio/ogg">' .
+                    '<audio %1$s>' .
+                        '<source src="http://example.com/getup.wav" type="audio/wav" />' .
+                        '<source src="http://example.com/getup.mp3" type="audio/mpeg" />' .
+                        '<source src="http://example.com/getup.ogg" type="audio/ogg" />' .
+                        'No tasty jams for you.' .
+                    '</audio>' .
+                '</div>'
+            ]) + $generatetestcases('Audio with sources and tracks', $audioattrs, [
+                '<audio %1$s>' .
+                    '<source src="http://example.com/getup.wav" type="audio/wav">' .
+                    '<track kind="subtitles" src="http://example.com/subtitles_en.vtt" label="English" srclang="en">' .
+                    '<track kind="subtitles" src="http://example.com/subtitles_es.vtt" label="Espanol" srclang="es">' .
+                    'No tasty jams for you.' .
+                '</audio>',
+                '<div class="text_to_html">' .
+                    '<audio %1$s>' .
+                        '<source src="http://example.com/getup.wav" type="audio/wav" />' .
+                        '<track kind="subtitles" src="http://example.com/subtitles_en.vtt" label="English" srclang="en" />' .
+                        '<track kind="subtitles" src="http://example.com/subtitles_es.vtt" label="Espanol" srclang="es" />' .
                         'No tasty jams for you.' .
                     '</audio>' .
                 '</div>'
             ]) + $generatetestcases('Plain video', $videoattrs + ['src="http://example.com/prettygood.mp4'], [
                 '<video %1$s>Oh, that\'s pretty bad 😦</video>',
                 '<div class="text_to_html"><video %1$s>Oh, that\'s pretty bad 😦</video></div>'
+            ]) + $generatetestcases('Video with illegal subtag', $videoattrs + ['src="http://example.com/prettygood.mp4'], [
+                '<video %1$s><subtag></subtag>Oh, that\'s pretty bad 😦</video>',
+                '<div class="text_to_html"><video %1$s>Oh, that\'s pretty bad 😦</video></div>'
+            ]) + $generatetestcases('Video with legal subtag', $videoattrs + ['src="http://example.com/prettygood.mp4'], [
+                '<video %1$s>Did not work <a href="http://example.com/prettygood.mp4">click here to download</a></video>',
+                '<div class="text_to_html"><video %1$s>Did not work <a href="http://example.com/prettygood.mp4">' .
+                'click here to download</a></video></div>'
+            ]) + $generatetestcases('Source tag without video or audio', $videoattrs, [
+                'some text <source src="http://example.com/getup.wav" type="audio/wav"> the end',
+                '<div class="text_to_html">some text  the end</div>'
             ]) + $generatetestcases('Video with one source', $videoattrs, [
                 '<video %1$s><source src="http://example.com/prettygood.mp4">Oh, that\'s pretty bad 😦</video>',
                 '<div class="text_to_html">' .
                     '<video %1$s>' .
-                        '<source src="http://example.com/prettygood.mp4">' .
+                        '<source src="http://example.com/prettygood.mp4" />' .
                         'Oh, that\'s pretty bad 😦' .
                     '</video>' .
                 '</div>'
@@ -397,38 +422,50 @@ class core_htmlpurifier_testcase extends basic_testcase {
                 '<video %1$s>' .
                     '<source src="http://example.com/prettygood.mp4" type="video/mp4">' .
                     '<source src="http://example.com/eljefe.mp4" type="video/mp4">' .
-                    '<source src="http://example.com/turnitup.mov type="video/mov"' .
+                    '<source src="http://example.com/turnitup.mov" type="video/mov">' .
                     'Oh, that\'s pretty bad 😦' .
                 '</video>',
                 '<div class="text_to_html">' .
                     '<video %1$s>' .
-                        '<source src="http://example.com/prettygood.mp4" type="video/mp4">' .
-                        '<source src="http://example.com/eljefe.mp4" type="video/mp4">' .
-                        '<source src="http://example.com/turnitup.mov type="video/mov"' .
+                        '<source src="http://example.com/prettygood.mp4" type="video/mp4" />' .
+                        '<source src="http://example.com/eljefe.mp4" type="video/mp4" />' .
+                        '<source src="http://example.com/turnitup.mov" type="video/mov" />' .
                         'Oh, that\'s pretty bad 😦' .
                     '</video>' .
                 '</div>'
-            ] + [
-                'Video with invalid crossorigin' => [
-                    '<video src="http://example.com/turnitup.mov type="video/mov crossorigin="can i pls hab?">' .
+            ]) + $generatetestcases('Video with sources and tracks', $audioattrs, [
+                '<video %1$s>' .
+                    '<source src="http://example.com/getup.wav" type="audio/wav">' .
+                    '<track kind="subtitles" src="http://example.com/subtitles_en.vtt" label="English" srclang="en">' .
+                    '<track kind="subtitles" src="http://example.com/subtitles_es.vtt" label="Espanol" srclang="es">' .
+                    'No tasty jams for you.' .
+                '</video>',
+                '<div class="text_to_html">' .
+                    '<video %1$s>' .
+                        '<source src="http://example.com/getup.wav" type="audio/wav" />' .
+                        '<track kind="subtitles" src="http://example.com/subtitles_en.vtt" label="English" srclang="en" />' .
+                        '<track kind="subtitles" src="http://example.com/subtitles_es.vtt" label="Espanol" srclang="es" />' .
+                    'No tasty jams for you.' .
+                    '</video>' .
+                '</div>'
+            ]) + $generatetestcases('Video with invalid crossorigin', $videoattrs, [
+                    '<video src="http://example.com/turnitup.mov" crossorigin="can i pls hab?">' .
                         'Oh, that\'s pretty bad 😦' .
                     '</video>',
                     '<div class="text_to_html">' .
-                       '<video src="http://example.com/turnitup.mov type="video/mov">' .
+                        '<video src="http://example.com/turnitup.mov">' .
                            'Oh, that\'s pretty bad 😦' .
-                        '</video>',
+                        '</video>' .
                     '</div>'
-                ],
-                'Audio with invalid crossorigin' => [
-                    '<audio src="http://example.com/getup.wav" type="audio/wav" crossorigin="give me. the jams.">' .
+            ]) + $generatetestcases('Audio with invalid crossorigin', $audioattrs, [
+                    '<audio src="http://example.com/getup.wav" crossorigin="give me. the jams.">' .
                         'nyemnyemnyem' .
                     '</audio>',
                     '<div class="text_to_html">' .
-                        '<audio src="http://example.com/getup.wav" type="audio/wav" crossorigin="give me. the jams.">' .
+                        '<audio src="http://example.com/getup.wav">' .
                             'nyemnyemnyem' .
                         '</audio>' .
                     '</div>'
-                ]
             ]);
     }
 }
diff --git a/lib/weblib.php b/lib/weblib.php
index 530a1f02119..357759b9f80 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -1822,7 +1822,7 @@ function purify_html($text, $options = array()) {
 
             // Media elements.
             // https://html.spec.whatwg.org/#the-video-element
-            $def->addElement('video', 'Block', 'Optional: (source, Flow) | (Flow, source) | Flow', 'Common', [
+            $def->addElement('video', 'Block', 'Optional: #PCDATA | Flow | source | track', 'Common', [
                 'src' => 'URI',
                 'crossorigin' => 'Enum#anonymous,use-credentials',
                 'poster' => 'URI',
@@ -1836,7 +1836,7 @@ function purify_html($text, $options = array()) {
                 'height' => 'Length',
             ]);
             // https://html.spec.whatwg.org/#the-audio-element
-            $def->addElement('audio', 'Block', 'Optional: (source, Flow) | (Flow, source) | Flow', 'Common', [
+            $def->addElement('audio', 'Block', 'Optional: #PCDATA | Flow | source | track', 'Common', [
                 'src' => 'URI',
                 'crossorigin' => 'Enum#anonymous,use-credentials',
                 'preload' => 'Enum#auto,metadata,none',
@@ -1846,10 +1846,18 @@ function purify_html($text, $options = array()) {
                 'controls' => 'Bool'
             ]);
             // https://html.spec.whatwg.org/#the-source-element
-            $def->addElement('source', 'Block', 'Flow', 'Common', [
+            $def->addElement('source', false, 'Empty', null, [
                 'src' => 'URI',
                 'type' => 'Text'
             ]);
+            // https://html.spec.whatwg.org/#the-track-element
+            $def->addElement('track', false, 'Empty', null, [
+                'src' => 'URI',
+                'kind' => 'Enum#subtitles,captions,descriptions,chapters,metadata',
+                'srclang' => 'Text',
+                'label' => 'Text',
+                'default' => 'Bool',
+            ]);
 
             // Use the built-in Ruby module to add annotation support.
             $def->manager->addModule(new HTMLPurifier_HTMLModule_Ruby());