Index: modules/filter/filter.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/filter/filter.test,v
retrieving revision 1.12
diff -u -p -r1.12 filter.test
--- modules/filter/filter.test	28 Dec 2008 19:30:36 -0000	1.12
+++ modules/filter/filter.test	9 Jan 2009 22:11:11 -0000
@@ -197,9 +197,262 @@ class FilterTestCase extends DrupalWebTe
   }
 
   /**
-   * Test the line break filter
+   * Test limiting allowed tags, XSS prevention and adding 'nofollow' to links.
+   * XSS tests assume that script is dissallowed on default and src is allowed on default, but on* and style are dissallowed.
+   *
+   * Script injection vectors mostly adopted from http://ha.ckers.org/xss.html.
+   *
+   * Relevant CVEs: 
+   *     CVE-2002-1806, ~CVE-2005-0682, ~CVE-2005-2106, CVE-2005-3973, 
+   *     CVE-2006-1226 (= rev. 1.112?), CVE-2008-0273, CVE-2008-3740.
+   *
+   * TODO: Maybe separate all filter_filter tests into another, higher level, test case?
    */
-  function testLineBreakFilter() {
+  function testHtmlFilter() {
+
+    // Default filter settings.
+    $f = filter_filter('process', 0, 'no_such_format', '<script />');
+    $this->assertNoNormalized($f, 'script', t('HTML filter should always remove script tags.'));
+
+    $f = filter_filter('process', 0, 'no_such_format', '<iframe />');
+    $this->assertNoNormalized($f, 'iframe', t('HTML filter should always remove iframe tags.'));
+
+    $f = filter_filter('process', 0, 'no_such_format', '<object />');
+    $this->assertNoNormalized($f, 'object', t('HTML filter should always remove object tags.'));
+
+    $f = filter_filter('process', 0, 'no_such_format', '<style />');
+    $this->assertNoNormalized($f, 'style', t('HTML filter should always remove style tags.'));
+
+    $f = filter_filter('process', 0, 'no_such_format', '<img />');
+    $this->assertNoNormalized($f, 'img', t('HTML filter should remove img tags on default.'));
+
+    // Tag stripping.
+    $f = filter_xss('<script>alert(0)</script>');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping -- simple script without special characters.'));
+
+    $f = filter_xss('<script src="http://www.example.com" />');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping -- empty script with source.'));
+
+    $f = filter_xss('<ScRipt sRc=http://www.example.com/>');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- varying case.'));
+
+    $f = filter_xss("<script\nsrc\n=\nhttp://www.example.com/\n>");
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- multiline tag.'));
+
+    $f = filter_xss('<script/a src=http://www.example.com/a.js></script>');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- non whitespace character after tag name.'));
+
+    $f = filter_xss('<script/src=http://www.example.com/a.js></script>');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no space between tag and attribute.'));
+
+    $f = filter_xss("<\0scr\0ipt>alert(0)</script>"); // TODO: Vector needs confirmation (the <\0s part).
+    $this->assertNoNormalized($f, 'ipt', t('HTML tag stripping evasion -- breaking HTML with nulls.'));
+
+    $f = filter_xss("<scrscriptipt src=http://www.example.com/a.js>");
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- filter just removing "script".'));
+
+    $f = filter_xss('<<script>alert(0);//<</script>');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- double opening brackets.'));
+
+    $f = filter_xss('<script src=http://www.example.com/a.js?<b>');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no closing tag.'));
+
+    $f = filter_xss('<script>>'); // DRUPAL-SA-2008-047 (rev. 1.219) TODO: How would you use that?
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- double closing tag.'));
+   
+    $f = filter_xss('<script src=//www.example.com/.a>');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no scheme or ending slash.'));
+
+    $f = filter_xss('<script src=http://www.example.com/.a');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- no closing bracket.'));
+
+    $f = filter_xss('<script src=http://www.example.com/ <');
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- opening instead of closing bracket.'));
+
+    $f = filter_xss('<nosuchtag attribute="newScriptInjectionVector">');
+    $this->assertNoNormalized($f, 'nosuchtag', t('HTML tag stripping evasion -- unknown tag.'));
+
+    $f = filter_xss('<?xml:namespace ns="urn:schemas-microsoft-com:time">');
+    $this->assertTrue(stripos($f, '<?xml') === FALSE, t('HTML tag stripping evasion -- starting with a question sign (processing instructions).'));
+
+    $f = filter_xss('<t:set attributeName="innerHTML" to="&lt;script defer&gt;alert(0)&lt;/script&gt;">');
+    $this->assertNoNormalized($f, 't:set', t('HTML tag stripping evasion -- colon in the tag name (namespaces\' tricks).'));
+
+    $f = filter_xss('<img """><script>alert(0)</script>', array('img'));
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- a malformed image tag.'));
+
+    $f = filter_xss('<blockquote><script>alert(0)</script></blockquote>', array('blockquote'));
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- script in a blockqoute.'));
+
+    $f = filter_xss("<!--[if true]><script>alert(0)</script><![endif]-->");
+    $this->assertNoNormalized($f, 'script', t('HTML tag stripping evasion -- script within a comment.'));
+
+    // Dangerous attributes removal.
+    $f = filter_xss('<p onmouseover="http://www.example.com/">', array('p'));
+    $this->assertNoNormalized($f, 'onmouseover', t('HTML filter attributes removal -- events, no evasion.'));
+
+    $f = filter_xss('<li style="list-style-image: url(javascript:alert(0))">', array('li'));
+    $this->assertNoNormalized($f, 'style', t('HTML filter attributes removal -- style, no evasion.'));
+
+    $f = filter_xss('<img onerror   =alert(0)>', array('img')); 
+    $this->assertNoNormalized($f, 'onerror', t('HTML filter attributes removal evasion -- spaces before equals sign.'));
+
+    $f = filter_xss('<img onabort!#$%&()*~+-_.,:;?@[/|\]^`=alert(0)>', array('img'));
+    $this->assertNoNormalized($f, 'onabort', t('HTML filter attributes removal evasion -- non alphanumeric characters before equals sign.'));
+
+    $f = filter_xss('<img oNmediAError=alert(0)>', array('img')); 
+    $this->assertNoNormalized($f, 'onmediaerror', t('HTML filter attributes removal evasion -- varying case.'));
+
+    // TODO: The filter closes the p tag here with the first > from the attribute, I would rather expect it to 
+    // remove the style attribute (<tag a=">" /> is well-formed XML as far as I can tell), however this is not dangerous.
+    // $f = filter_xss('<p name=">\'>" style="background-image: url(&#12288;javascript:alert(0))"></p>', array('p'));
+    // $this->assertNoNormalized($f, 'style', t('HTML filter attributes removal evasion -- filter not distinguishing quotes.'));
+
+    $f = filter_xss("<img o\0nfocus\0=alert(0)>", array('img')); // TODO: Vector needs confirmation.
+    $this->assertNoNormalized($f, 'focus', t('HTML filter attributes removal evasion -- breaking with nulls.'));
+
+    // Only whitelisted scheme names in allowed attributes.
+    $f = filter_xss('<img src="javascript:alert(0)">', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- no evasion.'));
+
+    $f = filter_xss('<img src=javascript:alert(0)>', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- no quotes.'));
+
+    $f = filter_xss('<img src="javascript:confirm(0)">', array('img')); // A bit like CVE-2006-0070.
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- no alert ;)'));
+
+    $f = filter_xss('<img src=`javascript:alert(0)`>', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- grave accents.'));
+    
+    $f = filter_xss('<img dynsrc="javascript:alert(0)">', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- rare attribute.'));
+
+    $f = filter_xss('<table background="javascript:alert(0)">', array('table'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- another tag.'));
+
+    $f = filter_xss('<base href="javascript:alert(0);//">', array('base'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing -- one more attribute and tag.'));
+
+    $f = filter_xss('<img src="jaVaSCriPt:alert(0)">', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- varying case.'));
+
+    $f = filter_xss('<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#48;&#41;>', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- UTF-8 decimal encoding.'));
+
+    $f = filter_xss('<img src=&#00000106&#0000097&#00000118&#0000097&#00000115&#0000099&#00000114&#00000105&#00000112&#00000116&#0000058&#0000097&#00000108&#00000101&#00000114&#00000116&#0000040&#0000048&#0000041>', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- long UTF-8 encoding.'));
+
+    $f = filter_xss('<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x30&#x29>', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- UTF-8 hex encoding.'));
+
+    $f = filter_xss("<img src=\"jav\tascript:alert(0)\">", array('img'));
+    $this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an embedded tab.'));
+
+    $f = filter_xss('<img src="jav&#x09;ascript:alert(0)">', array('img'));
+    $this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an encoded, embedded tab.'));
+
+    $f = filter_xss('<img src="jav&#x000000A;ascript:alert(0)">', array('img'));
+    $this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an encoded, embedded newline.'));
+
+    $f = filter_xss('<img src="jav&#x0D;ascript:alert(0)">', array('img')); // With &#xD; this test would fail, but the entity gets turned into &amp;#xD;, so it's OK.
+    $this->assertNoNormalized($f, 'script', t('HTML scheme clearing evasion -- an encoded, embedded carriage return.'));
+
+    $f = filter_xss("<img src=\"\n\n\nj\na\nva\ns\ncript:alert(0)\">", array('img'));
+    $this->assertNoNormalized($f, 'cript', t('HTML scheme clearing evasion -- broken into many lines.'));
+
+    $f = filter_xss("<img src=\"jav\0a\0\0cript:alert(0)\">", array('img'));
+    $this->assertNoNormalized($f, 'cript', t('HTML scheme clearing evasion -- embedded nulls.'));
+
+    $f = filter_xss('<img src=" &#14;  javascript:alert(0)">', array('img'));
+    $this->assertNoNormalized($f, 'javascript', t('HTML scheme clearing evasion -- spaces and metacharacters before scheme.'));
+
+    $f = filter_xss('<img src="vbscript:msgbox(0)">', array('img'));
+    $this->assertNoNormalized($f, 'vbscript', t('HTML scheme clearing evasion -- another scheme.'));
+
+    $f = filter_xss('<img src="nosuchscheme:notice(0)">', array('img'));
+    $this->assertNoNormalized($f, 'nosuchscheme', t('HTML scheme clearing evasion -- unknown scheme.'));
+
+    // Netscape 4.x javascript entities.
+    $f = filter_xss('<br size="&{alert(0)}">', array('br'));
+    $this->assertNoNormalized($f, 'alert', t('Netscape 4.x javascript entities.'));
+
+    // Encoding tricks.
+    // TODO: I can't really reproduce that attack, with 5.x input with invalid 
+    // characters is truncated, with 7.x the database layer throws an exception 
+    // (disclosing installation path, by the way).
+    $f = filter_xss("<p arg=\"\xe0\">\" style=\"background-image: url(javascript:alert(0));\"\xe0<p>", array('p')); // DRUPAL-SA-2008-006
+    $this->assertNoNormalized($f, 'style', t('HTML filter -- invalid UTF-8.'));
+
+    $f = filter_xss("\xc0<script>alert(0)</script>");
+    $this->assertEqual($f, '', t('HTML filter -- overlong UTF-8 sequences.'));
+  }
+
+  /**
+   * Test the spam deterrent.
+   */
+  function testNoFollowFilter() {
+    variable_set('filter_html_nofollow_f', TRUE);
+
+    $f = _filter_html('<a href="http://www.example.com/">text</a>', 'f');
+    $this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent -- no evasion.'));
+
+    $f = _filter_html('<A href="http://www.example.com/">text</a>', 'f');
+    $this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- capital A.'));
+
+    $f = _filter_html("<a/href=\"http://www.example.com/\">text</a>", 'f');
+    $this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- non whitespace character after tag name.'));
+
+    $f = _filter_html("<\0a\0 href=\"http://www.example.com/\">text</a>", 'f');
+    $this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- some nulls.'));
+
+    $f = _filter_html('<!--[if true]><a href="http://www.example.com/">text</a><![endif]-->', 'f');
+    $this->assertNormalized($f, 'rel="nofollow"', t('Spam deterrent evasion -- link within a comment.'));
+  }
+
+  /**
+   * Test the loose, admin HTML filter.
+   */
+  function testAdminHtmlFilter() {
+
+    $f = filter_xss_admin('<object />'); // DRUPAL-SA-2008-044
+    $this->assertNoNormalized($f, 'object', t('Admin HTML filter -- should not allow object tag.'));
+
+    $f = filter_xss_admin('<script />');
+    $this->assertNoNormalized($f, 'script', t('Admin HTML filter -- should not allow script tag.'));
+
+    $f = filter_xss_admin('<style /><iframe /><frame /><frameset /><meta /><link /><embed /><applet /><param /><layer />');
+    $this->assertEqual($f, '', t('Admin HTML filter -- should not allow some tags.'));
+  }
+
+  /**
+   * Test the HTML escaping filter.
+   * TODO: Maybe it should be a check_plain test? And add one for check_markup too?
+   */
+  function testNoHtmlFilter() {
+    $f = filter_filter('process', 4, 'no_such_format', '<>&"');
+    $this->assertEqual($f, '&lt;&gt;&amp;&quot;', t('No HTML filter basic test.'));
+
+    $f = check_plain('\'');
+    $this->assertEqual($f, '&#039;', t('No HTML filter -- single quote.'));
+
+    $f = check_plain("\xc2\"");
+    $this->assertEqual($f, '', t('No HTML filter -- invalid UTF-8.'));
+  }
+
+  /**
+   * Test the line breaking filter.
+   */
+  function testLineBreakingFilter() {
+    $f = _filter_autop("aaa\nbbb\n\nccc");
+    $this->assertEqual(str_replace("\n", '', $f), "<p>aaa<br />bbb</p><p>ccc</p>", t('Line breaking basic case.'));
+
+    $f = _filter_autop("<script>aaa\nbbb\n\nccc</script>");
+    $this->assertEqual($f, "<script>aaa\nbbb\n\nccc</script>", t('Line breaking -- do not break scripts.'));
+
+    // TODO: Filters do not skip comments.
+    // $f = _filter_autop("<!-- aaa\nbbb\n\nccc -->");
+    // $this->assertEqual($f, "<!-- aaa\nbbb\n\nccc -->", t('Line breaking -- do not change comments.'));
+
     $f = _filter_autop('<p><div>  </div></p>');
     $this->assertEqual(substr_count($f, '<p>'), substr_count($f, '</p>'), t('Make sure line breaking produces matching paragraph tags.'));
     
@@ -211,12 +464,85 @@ class FilterTestCase extends DrupalWebTe
   }
 
   /**
-   * Test the HTML filter
+   * Test the URL filter.
    */
-  function testHtmlFilter() {
+  function testUrlFilter() {
+    variable_set('filter_url_length_f', 496);
+
+    // Converting URLs.
+    $f = _filter_url('http://www.example.com/', 'f');
+    $this->assertEqual($f, '<a href="http://www.example.com/" title="http://www.example.com/">http://www.example.com/</a>', t('Converting URLs.'));
+
+    $f = _filter_url('http://www.example.com/?a=1&b=2', 'f');
+    $this->assertEqual($f, '<a href="http://www.example.com/?a=1&amp;b=2" title="http://www.example.com/?a=1&amp;b=2">http://www.example.com/?a=1&amp;b=2</a>', t('Converting URLs -- ampersands.'));
 
+    $f = _filter_url('ftp://user:pass@ftp.example.com/dir1/dir2', 'f');
+    $this->assertEqual($f, '<a href="ftp://user:pass@ftp.example.com/dir1/dir2" title="ftp://user:pass@ftp.example.com/dir1/dir2">ftp://user:pass@ftp.example.com/dir1/dir2</a>', t('Converting URLs -- FTP scheme.'));
+
+    $f = _filter_url('<a href="http://www.example.com/>www.example.com</a>', 'f');
+    $this->assertEqual($f, '<a href="http://www.example.com/>www.example.com</a>', t('Converting URLs -- do not break existing links.'));
+
+    // TODO: Filters break comment.
+    // $f = _filter_url('<!-- http://www.example.com -->', 'f');
+    // $this->assertEqual($f, '<!-- http://www.example.com -->', t('Converting URLs -- do not change comments.'));
+
+    // Converting domain names.
+    $f = _filter_url('www.example.com', 'f');
+    $this->assertEqual($f, '<a href="http://www.example.com" title="www.example.com">www.example.com</a>', t('Converting domain names.'));
+
+    $f = _filter_url('<li>www.example.com</li>', 'f');
+    $this->assertEqual($f, '<li><a href="http://www.example.com" title="www.example.com">www.example.com</a></li>', t('Converting domain names -- domain in a list.'));
+
+    $f = _filter_url('(www.example.com/dir?a=1&b=2#a)', 'f');
+    $this->assertEqual($f, '(<a href="http://www.example.com/dir?a=1&amp;b=2#a" title="www.example.com/dir?a=1&amp;b=2#a">www.example.com/dir?a=1&amp;b=2#a</a>)', t('Converting domain names --  domain with in parentheses.'));
+
+    // Converting e-mail addresses.
+    $f = _filter_url('johndoe@example.com', 'f');
+    $this->assertEqual($f, '<a href="mailto:johndoe@example.com">johndoe@example.com</a>', t('Converting e-mail addresses.'));
+
+    $f = _filter_url('aaa@sub.tv', 'f');
+    $this->assertEqual($f, '<a href="mailto:aaa@sub.tv">aaa@sub.tv</a>', t('Converting e-mail addresses -- a short e-mail from Tuvalu.'));
+
+    // TODO: Just doesn't work, see: http://tools.ietf.org/html/rfc5322#section-3.2.3 and http://tools.ietf.org/html/rfc5321#section-4.1.3 .
+    // $f = _filter_url('"\"\\()[]\;:,<>@ "!#$%&\'*+-/=?^_`.{|}~@example.com', 'f');
+    // $this->assertEqual($f, '<a href="mailto:"\"\\()[]\;:,<>@ "!#$%&\'*+-/=?^_`.{|}~@example.com">"\"\\()[]\;:,<>@ "!#$%&\'*+-/=?^_`.{|}~@example.com</a>', t('Converting e-mail addresses -- an interesting, valid address.'));
+
+    // URL trimming.
+    variable_set('filter_url_length_f', 28);
+
+    $f = _filter_url('http://www.example.com/d/ff.ext?a=1&b=2#a1', 'f');
+    $this->assertNormalized($f, 'http://www.example.com/d/ff....', t('URL trimming.'));
   }
 
+  /**
+   * Test the HTML corrector.
+   * TODO: This test could really use some validity checking function.
+   */
+  function testHtmlCorrector() {
+    $f = _filter_htmlcorrector('<p>text');
+    $this->assertEqual($f, '<p>text</p>', t('HTML corrector -- tag closing.'));
+
+    $f = _filter_htmlcorrector('<p>text<p><p>text');
+    $this->assertEqual($f, '<p>text</p><p></p><p>text</p>', t('HTML corrector -- tag closing.'));
+
+    $f = _filter_htmlcorrector("<ul><li>e1<li>e2");
+    $this->assertEqual($f, "<ul><li>e1</li><li>e2</li></ul>", t('HTML corrector -- unclosed list tags.'));
+
+    $f = _filter_htmlcorrector('<div id="d">content');
+    $this->assertEqual($f, '<div id="d">content</div>', t('HTML corrector -- unclosed tag with attribute.'));
+
+    $f = _filter_htmlcorrector('<hr><br>');
+    $this->assertEqual($f, '<hr /><br />', t('HTML corrector -- XHTML closing slash.'));
+
+    // TODO: Filters do not handle comments (issue #222926).
+    // $f = _filter_htmlcorrector('<!-- <p> comment -->');
+    // $this->assertEqual($f, '<!-- <p> comment -->', t('HTML corrector -- skiping comments.'));
+
+    // $f = _filter_htmlcorrector("<!-- comment\n<p> content\ncontent");
+    // $this->assertEqual($f, "<!-- comment\n<p> content\ncontent-->", t('HTML corrector -- closing unclosed comments.'));
+  }
+
+
   function createFormat($filter) {
     $edit = array(
       'name' => $this->randomName(),
@@ -233,4 +559,43 @@ class FilterTestCase extends DrupalWebTe
       $this->drupalPost('admin/settings/filters/delete/' . $format->format, array(), t('Delete'));
     }
   }
+ 
+  /**
+   * Asserts that a text transformed to lowercase with HTML entities decoded does contains a given string.
+   * Otherwise fails the test with a given message, similar to all the SimpleTest assert* functions.
+   * Note that this does not remove nulls, newlines and other that could be used to obscure a tag or an attribute name.
+   * @param $haystack
+   *   Text to look in.
+   * @param $needle
+   *   Lowercase, plain text to look for.
+   * @param $message
+   *   Message to display if failed.
+   * @param $group
+   *   The group this message belongs to, defaults to 'Other'.
+   * @return
+   *   TRUE on pass, FALSE on fail.
+   */
+  function assertNormalized($haystack, $needle, $message = '', $group = 'Other') {
+    return $this->assertTrue(strpos(strtolower(decode_entities($haystack)), $needle) !== FALSE, $message, $group);
+  }
+
+  /**
+   * Asserts that a text transformed to lowercase with HTML entities decoded does not contain a given string.
+   * Otherwise fails the test with a given message, similar to all the SimpleTest assert* functions.
+   * Note that this does not remove nulls, newlines and other that could be used to obscure a tag or an attribute name.
+   * @param $haystack
+   *   Text to look in.
+   * @param $needle
+   *   Lowercase, plain text to look for.
+   * @param $message
+   *   Message to display if failed.
+   * @param $group
+   *   The group this message belongs to, defaults to 'Other'.
+   * @return
+   *   TRUE on pass, FALSE on fail.
+   */
+  function assertNoNormalized($haystack, $needle, $message = '', $group = 'Other') {
+    return $this->assertTrue(strpos(strtolower(decode_entities($haystack)), $needle) === FALSE, $message, $group);
+  }
+
 }