add logging for url cleanup and more tests with links

lanwen · lanwen · commit 12aaa78273a4 · 2016-03-17T14:07:57.000+03:00
diff --git a/src/main/java/org/jenkinsci/plugins/github/util/XSSApi.java b/src/main/java/org/jenkinsci/plugins/github/util/XSSApi.java
@@ -1,12 +1,20 @@
 package org.jenkinsci.plugins.github.util;
 
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import java.net.MalformedURLException;
 import java.net.URL;
 
 /**
  * @author lanwen (Merkushev Kirill)
  */
+@Restricted(NoExternalUse.class)
 public final class XSSApi {
+    private static final Logger LOG = LoggerFactory.getLogger(XSSApi.class);
+
     private XSSApi() {
     }
 
@@ -21,6 +29,7 @@ public static String asValidHref(String urlString) {
         try {
             return new URL(urlString).toExternalForm();
         } catch (MalformedURLException e) {
+            LOG.debug("Malformed url - {}, empty string will be returned", urlString);
             return "";
         }
     }
diff --git a/src/test/java/org/jenkinsci/plugins/github/util/XSSApiTest.java b/src/test/java/org/jenkinsci/plugins/github/util/XSSApiTest.java
@@ -6,6 +6,7 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import static java.lang.String.format;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.is;
 
@@ -19,16 +20,26 @@ public class XSSApiTest {
     public static Object[][] links() {
         return new Object[][]{
                 new Object[]{"javascript:alert(1);//", ""},
+                new Object[]{"javascript:alert(1)://", ""},
                 new Object[]{"http://abcxyz.com?a=b&c=d';alert(1);//", "http://abcxyz.com?a=b&c=d';alert(1);//"},
                 new Object[]{"http://github.com/bla/bla", "http://github.com/bla/bla"},
                 new Object[]{"https://github.com/bla/bla", "https://github.com/bla/bla"},
-                new Object[]{"https://company.com/bla", "https://company.com/bla"}
+                new Object[]{"https://company.com/bla", "https://company.com/bla"},
+                new Object[]{"/company.com/bla", ""},
+                new Object[]{"//", ""},
+                new Object[]{"//text", ""},
+                new Object[]{"//text/", ""},
+                new Object[]{"ftp://", "ftp:"},
+                new Object[]{"ftp://a", "ftp://a"},
+                new Object[]{"text", ""},
+                new Object[]{"github.com/bla/bla", ""},
+                new Object[]{"http://127.0.0.1/", "http://127.0.0.1/"},
         };
     }
 
     @Test
     @UseDataProvider("links")
     public void shouldSanitizeUrl(String url, String expected) throws Exception {
-        assertThat(XSSApi.asValidHref(url), is(expected));
+        assertThat(format("For %s", url), XSSApi.asValidHref(url), is(expected));
     }
 }
