40 lines
1.5 KiB
JavaScript
40 lines
1.5 KiB
JavaScript
|
// Generated, do not edit. sha256:d90f8fe12862c6daa6656fef5bf8ba13b2a3cb9d3b9cb9d68c08cde20d6f7420
|
||
|
|
import { describe, it } from 'node:test';
|
||
|
|
import assert from 'node:assert/strict';
|
||
|
|
import { esc } from '../../client/ui/escape.js';
|
||
|
|
|
||
|
|
describe('esc', () => {
|
||
|
|
it('escapes the five characters that can make HTML structure', () => {
|
||
|
|
assert.equal(esc('&'), '&');
|
||
|
|
assert.equal(esc('<'), '<');
|
||
|
|
assert.equal(esc('>'), '>');
|
||
|
|
assert.equal(esc('"'), '"');
|
||
|
|
assert.equal(esc("'"), ''');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('a script payload no longer becomes a tag', () => {
|
||
|
|
assert.equal(esc('<img src=x onerror="alert(1)">'), '<img src=x onerror="alert(1)">');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('does not break out of a quoted attribute value', () => {
|
||
|
|
const html = `<div title="${esc('" onmouseover="alert(1)')}"></div>`;
|
||
|
|
assert.equal(html, '<div title="" onmouseover="alert(1)"></div>');
|
||
|
|
assert.equal(html.split('"').length - 1, 2, 'only the two intended quotes');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('escapes & first, so no double entities appear', () => {
|
||
|
|
assert.equal(esc('<'), '<');
|
||
|
|
assert.equal(esc('<'), '&lt;');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('gives empty text for null and undefined, and keeps 0 and false', () => {
|
||
|
|
assert.equal(esc(null), '');
|
||
|
|
assert.equal(esc(undefined), '');
|
||
|
|
assert.equal(esc(0), '0');
|
||
|
|
assert.equal(esc(false), 'false');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('leaves ordinary text alone', () => {
|
||
|
|
assert.equal(esc('Rekening Café Spaar (2019)'), 'Rekening Café Spaar (2019)');
|
||
|
|
});
|
||
|
|
});
|