site-builder/craft/src/components/basic/Navbar.toHtml.test.ts

import { describe, test, expect } from 'vitest';
import { Navbar } from './Navbar';

const toHtml = (Navbar as any).toHtml;

describe('Navbar.toHtml hamburger accessibility (F2.3)', () => {
  test('mobile toggle button has an accessible name, aria-expanded, and aria-controls', () => {
    const { html } = toHtml({ showMobileMenu: true }, '');
    expect(html).toMatch(/class="navbar-hamburger"[^>]*aria-label="Toggle navigation menu"/);
    expect(html).toMatch(/aria-expanded="false"/);
    expect(html).toMatch(/aria-controls="navbar-links"/);
  });

  test('aria-controls target id exists on the links container', () => {
    const { html } = toHtml({ showMobileMenu: true }, '');
    expect(html).toContain('id="navbar-links"');
  });

  test('toggle script flips aria-expanded on click', () => {
    const { html } = toHtml({ showMobileMenu: true }, '');
    expect(html).toMatch(/setAttribute\(['"]aria-expanded['"]/);
  });

  test('no mobile menu: no hamburger button emitted', () => {
    const { html } = toHtml({ showMobileMenu: false }, '');
    expect(html).not.toContain('navbar-hamburger');
  });
});

describe('Navbar.toHtml XSS hardening (hoverColor/backgroundColor/ctaColor into <style>)', () => {
  test('a hoverColor value containing </style><script> is neutralized in the hover <style> block', () => {
    const malicious = '#fff}</style><script>alert(1)</script><style>{';
    const { html } = toHtml({ hoverColor: malicious }, '');
    expect(html).not.toContain('</style><script');
    expect(html).not.toContain('<script>alert(1)</script>');
  });

  test('a backgroundColor value containing </style><script> is neutralized (mobile media-query rule)', () => {
    const malicious = '#fff}</style><script>alert(2)</script><style>{';
    const { html } = toHtml({ backgroundColor: malicious, showMobileMenu: true }, '');
    expect(html).not.toContain('</style><script');
    expect(html).not.toContain('<script>alert(2)</script>');
  });

  test('a ctaColor value containing </style><script> is neutralized', () => {
    const malicious = '#fff}</style><script>alert(3)</script><style>{';
    const { html } = toHtml({ ctaColor: malicious }, '');
    expect(html).not.toContain('</style><script');
    expect(html).not.toContain('<script>alert(3)</script>');
  });

  test('a textColor value containing a quote breakout does not escape the hamburger span style attribute', () => {
    const malicious = '#333" onmouseover="alert(1)';
    const { html } = toHtml({ textColor: malicious, showMobileMenu: true }, '');
    expect(html).not.toMatch(/style="[^"]*"[^>]*onmouseover/);
  });

  test('normal colors still render correctly', () => {
    const { html } = toHtml({ hoverColor: '#ff0000', backgroundColor: '#123456', ctaColor: '#00ff00' }, '');
    expect(html).toMatch(/:hover\s*\{\s*color:\s*#ff0000/);
    expect(html).toContain('background-color:#123456');
  });
});