36 lines
1.5 KiB
TypeScript
36 lines
1.5 KiB
TypeScript
 
|
import { describe, test, expect } from 'vitest';
|
||
|
|
import { HeroSimple } from './HeroSimple';
|
||
|
|
|
||
|
|
const toHtml = (HeroSimple as any).toHtml;
|
||
|
|
|
||
|
|
describe('HeroSimple.toHtml textAlign enum sink (attacker-controlled prop, not enforced at runtime)', () => {
|
||
|
|
test('malicious textAlign value cannot break out of the content div style attribute', () => {
|
||
|
|
const { html } = toHtml({
|
||
|
|
heading: 'Hi',
|
||
|
|
subtitle: 'There',
|
||
|
|
textAlign: 'center;"><script>alert(1)</script>',
|
||
|
|
}, '');
|
||
|
|
expect(html).not.toContain('<script>alert(1)</script>');
|
||
|
|
expect(html).not.toContain('center;">');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('unrecognized textAlign value falls back to a safe default rather than being echoed raw', () => {
|
||
|
|
const { html } = toHtml({ heading: 'Hi', subtitle: 'There', textAlign: 'not-a-real-value' as any }, '');
|
||
|
|
expect(html).not.toContain('text-align:not-a-real-value');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('valid textAlign values are preserved', () => {
|
||
|
|
const { html: left } = toHtml({ heading: 'Hi', subtitle: 'There', textAlign: 'left' }, '');
|
||
|
|
expect(left).toContain('text-align:left');
|
||
|
|
const { html: right } = toHtml({ heading: 'Hi', subtitle: 'There', textAlign: 'right' }, '');
|
||
|
|
expect(right).toContain('text-align:right');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('normal default render is sane', () => {
|
||
|
|
const { html } = toHtml({ heading: 'Welcome', subtitle: 'Sub text' }, '');
|
||
|
|
expect(html).toContain('Welcome');
|
||
|
|
expect(html).toContain('Sub text');
|
||
|
|
expect(html).toContain('text-align:center');
|
||
|
|
});
|
||
|
|
});
|