76 lines
3.2 KiB
TypeScript
76 lines
3.2 KiB
TypeScript
 
|
import { describe, test, expect } from 'vitest';
|
||
|
|
import { Section } from './Section';
|
||
|
|
|
||
|
|
const toHtml = (Section as any).toHtml;
|
||
|
|
|
||
|
|
describe('Section.toHtml anchorId', () => {
|
||
|
|
test('escapes a malicious anchorId (attribute breakout attempt)', () => {
|
||
|
|
const { html } = toHtml({ anchorId: 'x" onmouseover="alert(1)' }, 'child');
|
||
|
|
expect(html).not.toContain('onmouseover="alert(1)"');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a normal anchorId still renders correctly', () => {
|
||
|
|
const { html } = toHtml({ anchorId: 'my-section' }, 'child');
|
||
|
|
expect(html).toContain('id="my-section"');
|
||
|
|
});
|
||
|
|
});
|
||
|
|
|
||
|
|
describe('Section.toHtml childrenHtml passthrough', () => {
|
||
|
|
test('children are preserved', () => {
|
||
|
|
const { html } = toHtml({}, '<p>hello</p>');
|
||
|
|
expect(html).toContain('<p>hello</p>');
|
||
|
|
});
|
||
|
|
});
|
||
|
|
|
||
|
|
describe('Section.toHtml shape divider color/height XSS hardening', () => {
|
||
|
|
test('a malicious topDividerColor cannot break out of the SVG style attribute', () => {
|
||
|
|
const malicious = 'red" onmouseover="alert(1)';
|
||
|
|
const { html } = toHtml({ topDivider: 'wave', topDividerColor: malicious }, '');
|
||
|
|
expect(html).not.toContain('onmouseover="alert(1)"');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a malicious topDividerColor cannot inject a </style><script> breakout', () => {
|
||
|
|
const malicious = 'red</style><script>alert(1)</script>';
|
||
|
|
const { html } = toHtml({ topDivider: 'wave', topDividerColor: malicious }, '');
|
||
|
|
expect(html).not.toContain('<script>alert(1)</script>');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a malicious bottomDividerHeight cannot break out of the wrapper style attribute', () => {
|
||
|
|
const malicious = '50px" onmouseover="alert(1)';
|
||
|
|
const { html } = toHtml({ bottomDivider: 'angle', bottomDividerHeight: malicious }, '');
|
||
|
|
expect(html).not.toContain('onmouseover="alert(1)"');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a normal divider color/height still renders correctly', () => {
|
||
|
|
const { html } = toHtml({ topDivider: 'wave', topDividerColor: '#123456', topDividerHeight: '80px' }, '');
|
||
|
|
expect(html).toContain('fill:#123456');
|
||
|
|
expect(html).toContain('height:80px');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('divider shape "none" emits no divider markup', () => {
|
||
|
|
const { html } = toHtml({ topDivider: 'none' }, 'child');
|
||
|
|
expect(html).not.toContain('<svg');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('an unrecognized divider shape value emits no divider markup and no injected content', () => {
|
||
|
|
const malicious = 'wave"><script>alert(1)</script>' as any;
|
||
|
|
const { html } = toHtml({ topDivider: malicious }, 'child');
|
||
|
|
expect(html).not.toContain('<script>alert(1)</script>');
|
||
|
|
expect(html).not.toContain('<svg');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a prototype-property-name divider shape (__proto__) does not leak [object Object]/function source into the SVG path', () => {
|
||
|
|
const { html } = toHtml({ topDivider: '__proto__' as any }, 'child');
|
||
|
|
expect(html).not.toContain('[object');
|
||
|
|
expect(html).not.toContain('native code');
|
||
|
|
expect(html).not.toContain('<svg');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a prototype-property-name divider shape (toString) does not leak Object.prototype.toString source into the SVG path', () => {
|
||
|
|
const { html } = toHtml({ topDivider: 'toString' as any }, 'child');
|
||
|
|
expect(html).not.toContain('[object');
|
||
|
|
expect(html).not.toContain('native code');
|
||
|
|
expect(html).not.toContain('<svg');
|
||
|
|
});
|
||
|
|
});
|