# -*-perl-*-

use strict;
use Test::More 'no_plan';
use lib "$ENV{LJHOME}/cgi-bin";
require 'ljlib.pl';
require 'cleanhtml.pl';
use HTMLCleaner;

my $lju_sys = LJ::ljuser("system");

my $clean = sub {
    my $raw = shift;
    my %opts = @_;
    LJ::CleanHTML::clean_event(\$raw, {
    });
    return $raw;
};

my $html;

$html = $clean->(qq{
 My video: [<lj-template name="photobucket-video" width="352" height="308">
  http://vidmg.photobucket.com/albums/0603/awelch/videos/MVI_2967.flv
</lj-template>]
});

like($html, qr/<embed/, "got embedded video");


$html = $clean->(qq{
    <lj-template name="video" width="optional" height="optional" content-type="optional">http://mischa.com</lj-template>
});

like($html, qr/invalid/i, "invalid whitelisted video");

$html = $clean->(qq{
    <lj-template name="video">http://www.youtube.com/blah</lj-template>
});

like($html, qr/<object/, "got embedded whitelisted video");

$html = $clean->(qq{
    <lj-template name="video">http://youtube.com/blah</lj-template>
});

like($html, qr/<object/, "got embedded whitelisted video");

$html = $clean->(qq{
    <lj-template name="video">http://youtube.com/watch?v=weTDD1wTHDw</lj-template>
});

like($html, qr/<object/, "got embedded whitelisted video");

# naive attacker
$html = $clean->(qq{
 My attack: [<lj-template name="video" width="352" height="308">
  http://attacker.com/naive/
</lj-template>]
});
unlike($html, qr/<embed/, "no embedded video w/ naive attacker");

# tricking the regexp (forward slash in subdomain)
$html = $clean->(qq{
 My attack: [<lj-template name="video" width="352" height="308">
  http://attacker.com/idmg.photobucket.com/albums/0603/awelch/videos/MVI_2967.flv
</lj-template>]
});
like($html, qr/Invalid video url/i, "attacker tricking regexp with slashes in subdomain");

# attack by embedding other site's url
$html = $clean->(qq{
 My attack: [<lj-template name="video" width="352" height="308">
             http://youtube.com/p.swf?video_id=1&iurl=http://homestarrunner.com/firsttime.swf
</lj-template>]
});
like($html, qr/Invalid video url/i, "attacker tricking regexp by forwarding to other site's flash");

# autoplay
$html = $clean->(qq{
    <lj-template name="video">http://www.youtube.com/blah?autoplay=1</lj-template>
});

like($html, qr/Invalid/, "no autoplay");


# embedding arbitrary photobucket video w/ exploit
$html = $clean->(qq{
    <lj-template name="video">http://i106.photobucket.com/albums/m271/revmischa/untitled-1.swf</lj-template>
});

like($html, qr/Invalid/, "no arbitrary swf embedding with photobucket");