22 lines
1016 B
JavaScript
22 lines
1016 B
JavaScript
|
// Generated, do not edit. sha256:92455022533d94af2d52395e44cf486657d20b65fb083e71739944b000a7e846
|
||
|
|
import { describe, it } from 'node:test';
|
||
|
|
import assert from 'node:assert/strict';
|
||
|
|
|
||
|
|
import { val, fmtUnit } from '../../client/ui/format.js';
|
||
|
|
|
||
|
|
describe('val: privacy-wrap als keuzepunt', () => {
|
||
|
|
it('wrapt in .val zodat de blur-laag het kan vervagen', () => {
|
||
|
|
assert.equal(val('€ 1.234,56'), '<span class="val">€ 1.234,56</span>');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('escapet zijn invoer, want die gaat naar innerHTML', () => {
|
||
|
|
assert.equal(val('<b>x</b>'), '<span class="val"><b>x</b></span>');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('houdt een label uit de asset-data onschadelijk (de reden dat val() escapet)', () => {
|
||
|
|
const boosAsset = { kind: 'crypto', decimals: 0, unit: '<img src=x onerror=alert(1)>', displayUnit: 'unit' };
|
||
|
|
const html = val(fmtUnit(5, boosAsset));
|
||
|
|
assert.ok(!html.includes('<img'), `payload kwam als tag door: ${html}`);
|
||
|
|
assert.ok(html.includes('<img src=x onerror=alert(1)>'), html);
|
||
|
|
});
|
||
|
|
});
|