27 lines
1015 B
TypeScript
27 lines
1015 B
TypeScript
 
|
import { describe, test, expect } from 'vitest';
|
||
|
|
import { Spacer } from './Spacer';
|
||
|
|
|
||
|
|
const toHtml = (Spacer as any).toHtml;
|
||
|
|
|
||
|
|
describe('Spacer.toHtml normal rendering', () => {
|
||
|
|
test('renders height into the style attribute', () => {
|
||
|
|
const { html } = toHtml({ height: '80px' }, '');
|
||
|
|
expect(html).toContain('height:80px');
|
||
|
|
});
|
||
|
|
});
|
||
|
|
|
||
|
|
describe('Spacer.toHtml XSS hardening (height into style=)', () => {
|
||
|
|
test('a height value with an attribute-breakout string cannot escape style=""', () => {
|
||
|
|
const malicious = '40px" onmouseover="alert(1)';
|
||
|
|
const { html } = toHtml({ height: malicious as any }, '');
|
||
|
|
expect(html).not.toMatch(/"\s+onmouseover="/);
|
||
|
|
expect(html).not.toMatch(/style="[^"]*"[^>]*onmouseover/);
|
||
|
|
});
|
||
|
|
|
||
|
|
test('a height value with a </style><script> breakout is neutralized', () => {
|
||
|
|
const malicious = '40px</style><script>alert(1)</script>';
|
||
|
|
const { html } = toHtml({ height: malicious as any }, '');
|
||
|
|
expect(html).not.toContain('<script>alert(1)</script>');
|
||
|
|
});
|
||
|
|
});
|