site-builder/craft/src/components/layout/Section.toHtml.test.ts

import { describe, test, expect } from 'vitest';
import { Section } from './Section';

const toHtml = (Section as any).toHtml;

describe('Section.toHtml anchorId', () => {
  test('escapes a malicious anchorId (attribute breakout attempt)', () => {
    const { html } = toHtml({ anchorId: 'x" onmouseover="alert(1)' }, 'child');
    expect(html).not.toContain('onmouseover="alert(1)"');
  });

  test('a normal anchorId still renders correctly', () => {
    const { html } = toHtml({ anchorId: 'my-section' }, 'child');
    expect(html).toContain('id="my-section"');
  });
});

describe('Section.toHtml childrenHtml passthrough', () => {
  test('children are preserved', () => {
    const { html } = toHtml({}, '<p>hello</p>');
    expect(html).toContain('<p>hello</p>');
  });
});

describe('Section.toHtml shape divider color/height XSS hardening', () => {
  test('a malicious topDividerColor cannot break out of the SVG style attribute', () => {
    const malicious = 'red" onmouseover="alert(1)';
    const { html } = toHtml({ topDivider: 'wave', topDividerColor: malicious }, '');
    expect(html).not.toContain('onmouseover="alert(1)"');
  });

  test('a malicious topDividerColor cannot inject a </style><script> breakout', () => {
    const malicious = 'red</style><script>alert(1)</script>';
    const { html } = toHtml({ topDivider: 'wave', topDividerColor: malicious }, '');
    expect(html).not.toContain('<script>alert(1)</script>');
  });

  test('a malicious bottomDividerHeight cannot break out of the wrapper style attribute', () => {
    const malicious = '50px" onmouseover="alert(1)';
    const { html } = toHtml({ bottomDivider: 'angle', bottomDividerHeight: malicious }, '');
    expect(html).not.toContain('onmouseover="alert(1)"');
  });

  test('a normal divider color/height still renders correctly', () => {
    const { html } = toHtml({ topDivider: 'wave', topDividerColor: '#123456', topDividerHeight: '80px' }, '');
    expect(html).toContain('fill:#123456');
    expect(html).toContain('height:80px');
  });

  test('divider shape "none" emits no divider markup', () => {
    const { html } = toHtml({ topDivider: 'none' }, 'child');
    expect(html).not.toContain('<svg');
  });

  test('an unrecognized divider shape value emits no divider markup and no injected content', () => {
    const malicious = 'wave"><script>alert(1)</script>' as any;
    const { html } = toHtml({ topDivider: malicious }, 'child');
    expect(html).not.toContain('<script>alert(1)</script>');
    expect(html).not.toContain('<svg');
  });

  test('a prototype-property-name divider shape (__proto__) does not leak [object Object]/function source into the SVG path', () => {
    const { html } = toHtml({ topDivider: '__proto__' as any }, 'child');
    expect(html).not.toContain('[object');
    expect(html).not.toContain('native code');
    expect(html).not.toContain('<svg');
  });

  test('a prototype-property-name divider shape (toString) does not leak Object.prototype.toString source into the SVG path', () => {
    const { html } = toHtml({ topDivider: 'toString' as any }, 'child');
    expect(html).not.toContain('[object');
    expect(html).not.toContain('native code');
    expect(html).not.toContain('<svg');
  });
});

describe('Section.toHtml vertical alignment (justify-content + min-height)', () => {
  // Regression lock: same rationale as Container -- see Container.toHtml.test.ts.
  // Section must not unconditionally become a flex container, or it
  // blockifies inline-block children (ButtonLink, Icon) that are meant to
  // sit side-by-side in existing published sections.
  test('does NOT become a flex container when no vertical alignment is set (plain block flow preserved)', () => {
    const { html } = toHtml({}, 'child');
    expect(html).not.toContain('display:flex');
    expect(html).not.toContain('flex-direction');
  });

  test('does NOT become a flex container from min-height alone (min-height must not itself trigger flex)', () => {
    const { html } = toHtml({ style: { minHeight: '600px' } }, 'child');
    expect(html).not.toContain('display:flex');
    expect(html).not.toContain('flex-direction');
    expect(html).toContain('min-height:600px');
  });

  test('becomes a column flex container when style.justifyContent is set (feature still works)', () => {
    const { html } = toHtml({ style: { justifyContent: 'center' } }, 'child');
    expect(html).toContain('display:flex');
    expect(html).toContain('flex-direction:column');
    expect(html).toContain('justify-content:center');
  });

  test('style.minHeight flows into the emitted style attribute', () => {
    const { html } = toHtml({ style: { minHeight: '600px' } }, 'child');
    expect(html).toContain('min-height:600px');
  });
});

describe('Section.toHtml box-model styles (margin/padding/border/shadow/opacity)', () => {
  test('margin/padding/border/box-shadow/opacity all flow into the emitted style attribute', () => {
    const { html } = toHtml(
      {
        style: {
          marginTop: '10px', marginRight: '10px', marginBottom: '10px', marginLeft: '10px',
          paddingTop: '5px',
          border: '2px solid #ff0000',
          boxShadow: '0 4px 8px rgba(0,0,0,0.12)',
          opacity: '0.8',
        },
      },
      'child',
    );
    expect(html).toContain('margin-top:10px');
    expect(html).toContain('padding-top:5px');
    expect(html).toContain('border:2px solid #ff0000');
    expect(html).toContain('box-shadow:0 4px 8px rgba(0,0,0,0.12)');
    expect(html).toContain('opacity:0.8');
  });
});

describe('Section.craft.props exposes the vertical-alignment/box-model/animation/visibility rollout', () => {
  test('animation, animationDelay, hideOnDesktop/Tablet/Mobile are present with blank/false defaults', () => {
    const props = (Section as any).craft.props;
    expect(props.animation).toBe('');
    expect(props.animationDelay).toBe('0');
    expect(props.hideOnDesktop).toBe(false);
    expect(props.hideOnTablet).toBe(false);
    expect(props.hideOnMobile).toBe(false);
  });

  test('style carries blank/default vertical-alignment and box-model keys', () => {
    const style = (Section as any).craft.props.style;
    expect(style).toHaveProperty('justifyContent');
    expect(style).toHaveProperty('minHeight');
    expect(style).toHaveProperty('marginTop');
    expect(style).toHaveProperty('paddingTop');
    expect(style.border).toBe('none');
    expect(style.boxShadow).toBe('none');
    expect(style.opacity).toBe('1');
  });
});