Files
site-builder/craft/src/components/sections/Gallery.toHtml.test.ts
T
shadowdaoandClaude Opus 4.8 3f3c6fb851 security: add safeImageUrl, un-break M-5's over-blocking of image-context SVG data URIs
M-5 made safeUrl() block data:image/svg+xml everywhere, including the
image-only sinks (<img src>, CSS url()) that Gallery's default images and
other SVG placeholders rely on. Loaded as an image, an SVG is rasterized
and never executes an inline <script>/onload= -- that only happens when
it's navigated to or loaded as an <iframe> document -- so M-5 over-blocked
the safe contexts and broke every published Gallery (and other components
using an SVG placeholder) using safeUrl's default images in prod.

Adds safeImageUrl(): identical javascript:/vbscript: handling to safeUrl,
but treats data: as an allowlist of image/* subtypes instead of a
blocklist -- allows all data:image/* (including svg+xml, with or without
base64), still blocks data:text/html and any other non-image data: type.

Swapped to safeImageUrl at IMAGE-src / CSS-image url() sinks only:
- Gallery.tsx img src + lightbox data-lb-src
- ImageBlock.tsx img src (toHtml)
- Logo.tsx / Navbar.tsx logo <img> src (their href/link targets keep safeUrl)
- style-helpers.ts sanitizeCssValue's url(...) handling (background-image
  for HeroSimple/BackgroundSection/Section/CallToAction)

Left on safeUrl (href/iframe/form-action/navigation sinks, where
data:image/svg+xml must stay blocked): ButtonLink, Icon link, SocialLinks,
Menu/Navbar link hrefs, PricingTable buttonHref, _cta-helpers,
ContentSlider buttonHref, FeaturesGrid buttonUrl, FormContainer action
(via form-relay-wiring), MapEmbed/VideoBlock iframe src.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 19:45:58 -07:00

152 lines
6.9 KiB
TypeScript

import { describe, test, expect } from 'vitest';
import { Gallery } from './Gallery';
const toHtml = (Gallery as any).toHtml;
describe('Gallery.toHtml lightbox uses a delegated listener, not per-item onclick (A4.3)', () => {
test('no per-item inline onclick with interpolated src', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg', alt: 'a' }], lightbox: true }, '');
expect(html).not.toMatch(/onclick="[^"]*_open\(/);
expect(html).toContain('data-lb-src="/a.jpg"');
});
test('a single-quote in src cannot break the handler (no per-item onclick at all)', () => {
const { html } = toHtml({ images: [{ src: "/a'.jpg", alt: 'a' }], lightbox: true }, '');
// no per-item onclick handler exists at all (delegated listener only)
expect(html).not.toMatch(/onclick="[^"]*_open\(/);
// the quote in src is entity-escaped in the data attribute, not raw
expect(html).toContain('data-lb-src="/a&#39;.jpg"');
expect(html).not.toContain(`data-lb-src="/a'.jpg"`);
});
test('emits exactly one delegated click listener', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg' }, { src: '/b.jpg' }], lightbox: true }, '');
const matches = html.match(/addEventListener\(['"]click['"]/g) || [];
expect(matches.length).toBe(1);
});
test('lightbox=false: no data-lb-src, no script', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg' }], lightbox: false }, '');
expect(html).not.toContain('data-lb-src');
expect(html).not.toContain('<script>');
});
});
describe('Gallery.toHtml lightbox accessibility (F1.3)', () => {
test('lightbox overlay has role="dialog", aria-modal, and aria-label', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg', alt: 'a' }], lightbox: true }, '');
expect(html).toMatch(/role="dialog"/);
expect(html).toMatch(/aria-modal="true"/);
expect(html).toMatch(/aria-label="[^"]+"/);
});
test('Escape closes the lightbox via the inline script', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg', alt: 'a' }], lightbox: true }, '');
expect(html).toMatch(/Escape/);
});
test('thumbnails are keyboard-operable when lightbox is enabled (role=button + tabindex=0)', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg', alt: 'a' }], lightbox: true }, '');
expect(html).toMatch(/data-lb-src="[^"]*"[^>]*role="button"[^>]*tabindex="0"/);
});
test('delegated listener handles Enter/Space for keyboard activation', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg' }, { src: '/b.jpg' }], lightbox: true }, '');
expect(html).toMatch(/addEventListener\(['"]keydown['"]/);
});
test('lightbox=false: no role="dialog", no role="button" thumbnails', () => {
const { html } = toHtml({ images: [{ src: '/a.jpg' }], lightbox: false }, '');
expect(html).not.toContain('role="dialog"');
expect(html).not.toContain('role="button"');
});
});
describe('Gallery.toHtml deterministic + unique scope ids (thread node id, no Math.random)', () => {
const props = { images: [{ src: '/a.jpg', alt: 'a' }], lightbox: true };
test('same node id -> identical output across calls (deterministic)', () => {
const { html: html1 } = toHtml(props, '', 'node-gal1');
const { html: html2 } = toHtml(props, '', 'node-gal1');
expect(html1).toBe(html2);
});
test('different node ids -> different, non-colliding gallery scope ids (identical images, no collision)', () => {
const { html: html1 } = toHtml(props, '', 'node-gal1');
const { html: html2 } = toHtml(props, '', 'node-gal2');
const id1 = html1.match(/id="([^"]+)_overlay"/)![1];
const id2 = html2.match(/id="([^"]+)_overlay"/)![1];
expect(id1).not.toBe(id2);
});
test('overlay/grid ids and the script function names all use the SAME scope', () => {
const { html } = toHtml(props, '', 'node-gal1');
const scope = html.match(/id="([^"]+)_overlay"/)![1];
expect(html).toContain(`id="${scope}_grid"`);
expect(html).toContain(`function ${scope}_close()`);
expect(html).toContain(`function ${scope}_open(`);
});
test('no nodeId (legacy 2-arg call): still deterministic across repeated calls, not random', () => {
const { html: html1 } = toHtml(props, '');
const { html: html2 } = toHtml(props, '');
expect(html1).toBe(html2);
});
});
describe('Gallery.toHtml default SVG placeholder images survive export (Bug 2 regression)', () => {
test('a default data:image/svg+xml image emits a non-empty img src, not src=""', () => {
const { html } = toHtml({}, ''); // no images prop -> component default SVG placeholders
expect(html).not.toContain('src=""');
expect(html).toMatch(/src="data:image\/svg\+xml[^"]*"/);
});
test('an explicit data:image/svg+xml gallery image src is preserved (not stripped to empty)', () => {
const svg = 'data:image/svg+xml,%3Csvg%2F%3E';
const { html } = toHtml({ images: [{ src: svg, alt: 'a' }] }, '');
expect(html).toContain(`src="${svg}"`);
});
test('lightbox data-lb-src also preserves data:image/svg+xml (still an image context)', () => {
const svg = 'data:image/svg+xml,%3Csvg%2F%3E';
const { html } = toHtml({ images: [{ src: svg, alt: 'a' }], lightbox: true }, '');
expect(html).toContain(`data-lb-src="${svg}"`);
});
test('a javascript: gallery image src still yields an empty src (safeImageUrl still blocks it)', () => {
const { html } = toHtml({ images: [{ src: 'javascript:alert(1)', alt: 'a' }] }, '');
expect(html).toContain('src=""');
expect(html).not.toContain('javascript:');
});
});
describe('Gallery.toHtml lightbox focus management (M-2)', () => {
const props = { images: [{ src: '/a.jpg', alt: 'a' }], lightbox: true };
test('overlay includes a focusable close control with an accessible name and tabindex', () => {
const { html } = toHtml(props, '', 'node-gal1');
// A close control: a button (or the dialog container) with an accessible
// name (aria-label) and an explicit tabindex so it's keyboard-focusable.
expect(html).toMatch(/aria-label="[^"]*[Cc]lose[^"]*"[^>]*tabindex="-?\d+"|tabindex="-?\d+"[^>]*aria-label="[^"]*[Cc]lose[^"]*"/);
});
test('script saves document.activeElement on open (for focus restore)', () => {
const { html } = toHtml(props, '', 'node-gal1');
expect(html).toMatch(/document\.activeElement/);
});
test('script moves focus to the close control / dialog on open', () => {
const { html } = toHtml(props, '', 'node-gal1');
expect(html).toMatch(/\.focus\(\)/);
});
test('script restores the previously-saved focus on close', () => {
const { html } = toHtml(props, '', 'node-gal1');
// The close function references a stored "last focused element" variable
// and calls .focus() on it, not just moving focus INTO the dialog.
const closeFnMatch = html.match(/function\s+\w+_close\s*\(\)\s*\{[^}]*\}/);
expect(closeFnMatch).not.toBeNull();
expect(closeFnMatch![0]).toMatch(/\.focus\(\)/);
});
});