site-builder/craft/src/components/basic/StarRating.toHtml.test.ts

import { describe, test, expect } from 'vitest';
import { StarRating } from './StarRating';

const toHtml = (StarRating as any).toHtml;

describe('StarRating.toHtml accessibility (F2.2)', () => {
  test('wrapper has role="img" and a "Rating: N out of maxStars" aria-label', () => {
    const { html } = toHtml({ rating: 4.5, maxStars: 5 }, '');
    expect(html).toMatch(/<span role="img" aria-label="Rating: 4\.5 out of 5"/);
  });

  test('individual star glyphs are aria-hidden', () => {
    const { html } = toHtml({ rating: 3, maxStars: 5 }, '');
    const glyphs = html.match(/<i class="fa fa-star"[^>]*>/g) || [];
    expect(glyphs.length).toBeGreaterThan(0);
    glyphs.forEach((tag: string) => expect(tag).toContain('aria-hidden="true"'));
  });

  test('respects custom maxStars in the aria-label', () => {
    const { html } = toHtml({ rating: 2, maxStars: 10 }, '');
    expect(html).toContain('aria-label="Rating: 2 out of 10"');
  });
});

describe('StarRating.toHtml XSS hardening (filledColor/emptyColor/size into style=)', () => {
  test('a filledColor value containing a quote breakout is neutralized', () => {
    const malicious = '#f00" onmouseover="alert(1)';
    const { html } = toHtml({ rating: 3, maxStars: 5, filledColor: malicious }, '');
    expect(html).not.toMatch(/style="[^"]*"[^>]*onmouseover/);
  });

  test('a size value containing </style><script> is neutralized', () => {
    const malicious = '24px</style><script>alert(1)</script>';
    const { html } = toHtml({ rating: 3, maxStars: 5, size: malicious }, '');
    expect(html).not.toContain('<script>alert(1)</script>');
  });

  test('a normal filled color still renders', () => {
    const { html } = toHtml({ rating: 5, maxStars: 5, filledColor: '#ff9900' }, '');
    expect(html).toContain('color:#ff9900');
  });
});