site-builder/craft/src/utils/escape.test.ts

import { describe, test, expect } from 'vitest';
import { escapeHtml, escapeAttr, safeUrl } from './escape';

describe('escapeHtml', () => {
  test('escapes &, <, >, "', () => {
    expect(escapeHtml('a & b <c> "d"')).toBe('a &amp; b &lt;c&gt; &quot;d&quot;');
  });

  test('escapes ampersand first (no double-escaping)', () => {
    expect(escapeHtml('&amp;')).toBe('&amp;amp;');
  });

  test('coerces non-string / null / undefined safely', () => {
    expect(escapeHtml(null as any)).toBe('');
    expect(escapeHtml(undefined as any)).toBe('');
    expect(escapeHtml(123 as any)).toBe('123');
  });
});

describe('escapeAttr', () => {
  test('does everything escapeHtml does', () => {
    expect(escapeAttr('a & b <c> "d"')).toBe('a &amp; b &lt;c&gt; &quot;d&quot;');
  });

  test('also escapes single quote and backtick', () => {
    expect(escapeAttr(`'`)).toBe('&#39;');
    expect(escapeAttr('`')).toBe('&#96;');
  });

  test('combined example', () => {
    expect(escapeAttr(`it's a "test" <b>\``)).toBe('it&#39;s a &quot;test&quot; &lt;b&gt;&#96;');
  });

  test('coerces non-string / null / undefined safely', () => {
    expect(escapeAttr(null as any)).toBe('');
    expect(escapeAttr(undefined as any)).toBe('');
  });
});

describe('safeUrl', () => {
  test('blocks javascript: scheme', () => {
    expect(safeUrl('javascript:alert(1)')).toBe('');
  });

  test('blocks javascript: with leading whitespace and mixed case', () => {
    expect(safeUrl('  JavaScript:alert(1)')).toBe('');
  });

  test('blocks javascript: with tab/control-char obfuscation', () => {
    expect(safeUrl('java\tscript:alert(1)')).toBe('');
  });

  test('blocks entity-obfuscated javascript: scheme (decimal)', () => {
    expect(safeUrl('&#106;avascript:alert(1)')).toBe('');
  });

  test('blocks entity-obfuscated javascript: scheme (zero-padded decimal)', () => {
    expect(safeUrl('java&#0000058script:alert(1)')).toBe('');
  });

  test('blocks vbscript: scheme', () => {
    expect(safeUrl('vbscript:msgbox(1)')).toBe('');
  });

  test('blocks data:text/html', () => {
    expect(safeUrl('data:text/html;base64,PHNjcmlwdD4=')).toBe('');
  });

  test('allows data:image/png', () => {
    const s = 'data:image/png;base64,iVBORw0KGgo=';
    expect(safeUrl(s)).toBe(s);
  });

  test.each([
    'https://x.com/a?b=1&c=2',
    'http://x',
    '/relative/path',
    '#anchor',
    'mailto:a@b.com',
    'tel:+15551234',
    '',
  ])('allows %s unchanged (trimmed)', (input) => {
    expect(safeUrl(input)).toBe(input.trim());
  });

  test('coerces non-string to empty string', () => {
    expect(safeUrl(null as any)).toBe('');
    expect(safeUrl(undefined as any)).toBe('');
    expect(safeUrl(123 as any)).toBe('');
  });

  test('does not mangle query strings on allowed urls', () => {
    expect(safeUrl('https://x.com/a?b=1&c=2')).toBe('https://x.com/a?b=1&c=2');
  });
});