23 lines
920 B
TypeScript
23 lines
920 B
TypeScript
 
|
import { describe, test, expect } from 'vitest';
|
||
|
|
import { Footer } from './Footer';
|
||
|
|
|
||
|
|
const toHtml = (Footer as any).toHtml;
|
||
|
|
|
||
|
|
describe('Footer.toHtml text escaping (attacker-controlled `text` prop)', () => {
|
||
|
|
test('a tag-breakout attempt in text is neutralized (no injected element)', () => {
|
||
|
|
const { html } = toHtml({ text: '</footer><img src=x onerror=alert(1)>' }, '');
|
||
|
|
expect(html).not.toContain('<img');
|
||
|
|
expect(html).toContain('<img');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('ampersand is escaped for well-formed text content (consistency with escapeHtml)', () => {
|
||
|
|
const { html } = toHtml({ text: 'Terms & Conditions' }, '');
|
||
|
|
expect(html).toContain('Terms & Conditions');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a normal copyright text value still renders unchanged', () => {
|
||
|
|
const { html } = toHtml({ text: '© 2026 MySite. All rights reserved.' }, '');
|
||
|
|
expect(html).toContain('© 2026 MySite. All rights reserved.');
|
||
|
|
});
|
||
|
|
});
|