40 lines
1.8 KiB
TypeScript
40 lines
1.8 KiB
TypeScript
|
import { describe, test, expect } from 'vitest';
|
||
|
|
import { SubscribeForm } from './SubscribeForm';
|
||
|
|
|
||
|
|
const toHtml = (SubscribeForm as any).toHtml;
|
||
|
|
|
||
|
|
describe('SubscribeForm.toHtml hardcoded attributes stay hardcoded (no raw prop breakout)', () => {
|
||
|
|
test('form method is always POST regardless of any injected props', () => {
|
||
|
|
const { html } = toHtml({ heading: 'Join us', method: 'GET"><script>alert(1)</script>' } as any, '');
|
||
|
|
expect(html).toContain('<form method="POST"');
|
||
|
|
expect(html).not.toContain('<script');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('email input type is always "email" regardless of any injected props', () => {
|
||
|
|
const { html } = toHtml({ type: 'text"><img src=x onerror=alert(1)>' } as any, '');
|
||
|
|
expect(html).toContain('<input type="email"');
|
||
|
|
expect(html).not.toContain('<img');
|
||
|
|
expect(html).not.toContain('onerror=');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('layout enum only ever feeds one of two fixed literal style strings, never raw', () => {
|
||
|
|
const { html: inlineHtml } = toHtml({ layout: 'inline' }, '');
|
||
|
|
const { html: stackedHtml } = toHtml({ layout: 'stacked' }, '');
|
||
|
|
expect(inlineHtml).toContain('flex-direction:row');
|
||
|
|
expect(stackedHtml).toContain('flex-direction:column');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('malicious layout value cannot inject raw CSS/attribute breakout (falls through the isInline boolean check to the stacked literal)', () => {
|
||
|
|
const { html } = toHtml({ layout: '"><script>alert(1)</script>' as any }, '');
|
||
|
|
expect(html).not.toContain('<script');
|
||
|
|
expect(html).toContain('flex-direction:column');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('normal render still produces expected structure', () => {
|
||
|
|
const { html } = toHtml({ heading: 'Subscribe', placeholder: 'you@example.com', buttonText: 'Go' }, '');
|
||
|
|
expect(html).toContain('Subscribe');
|
||
|
|
expect(html).toContain('placeholder="you@example.com"');
|
||
|
|
expect(html).toContain('>Go<');
|
||
|
|
});
|
||
|
|
});
|