29 lines
1.1 KiB
TypeScript
29 lines
1.1 KiB
TypeScript
|
import { describe, test, expect } from 'vitest';
|
||
|
|
import { Countdown } from './Countdown';
|
||
|
|
|
||
|
|
const toHtml = (Countdown as any).toHtml;
|
||
|
|
|
||
|
|
describe('Countdown.toHtml validates targetDate before inline-script injection (A4.2)', () => {
|
||
|
|
test('malicious targetDate cannot break out of the new Date(...) call', () => {
|
||
|
|
const { html } = toHtml({ targetDate: '2026-01-01");alert(1)//' }, '');
|
||
|
|
expect(html).not.toContain('alert(');
|
||
|
|
expect(html).not.toContain('");');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('valid date is JSON-encoded into the script', () => {
|
||
|
|
const { html } = toHtml({ targetDate: '2026-01-01' }, '');
|
||
|
|
expect(html).toContain('new Date("2026-01-01")');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('valid date+time is preserved', () => {
|
||
|
|
const { html } = toHtml({ targetDate: '2026-01-01T12:30:00' }, '');
|
||
|
|
expect(html).toContain('new Date("2026-01-01T12:30:00")');
|
||
|
|
});
|
||
|
|
|
||
|
|
test('invalid/empty targetDate falls back safely (no injected literal)', () => {
|
||
|
|
const { html } = toHtml({ targetDate: 'not-a-date' }, '');
|
||
|
|
expect(html).not.toContain('not-a-date');
|
||
|
|
expect(html).toMatch(/new Date\(\)\.getTime\(\)|new Date\(Date\.now\(\)\)\.getTime\(\)/);
|
||
|
|
});
|
||
|
|
});
|