57 lines
1.9 KiB
TypeScript
57 lines
1.9 KiB
TypeScript
import { test } from '@japa/runner'
|
|
import {
|
|
sanitizePayload,
|
|
sanitizeRichText,
|
|
sanitizeUrl,
|
|
} from '#base_modules/WebManager/services/content_sanitizer'
|
|
|
|
test.group('Web Manager content sanitizer', () => {
|
|
test('rich text keeps allowed markup and drops event handlers', ({ assert }) => {
|
|
assert.equal(
|
|
sanitizeRichText('<p class="lead" onclick="alert(1)">Hi <em>there</em></p>'),
|
|
'<p class="lead">Hi <em>there</em></p>'
|
|
)
|
|
})
|
|
|
|
test('rich text drops dangerous subtrees entirely', ({ assert }) => {
|
|
assert.equal(
|
|
sanitizeRichText('before<script>alert(1)</script><svg><a onload="alert(1)"></a></svg>after'),
|
|
'beforeafter'
|
|
)
|
|
})
|
|
|
|
test('rich text rejects unsafe link schemes and normalizes rel', ({ assert }) => {
|
|
assert.equal(
|
|
sanitizeRichText('<a href="javascript:alert(1)" target="_blank" rel="me nofollow">x</a>'),
|
|
'<a target="_blank" rel="noopener noreferrer">x</a>'
|
|
)
|
|
assert.equal(
|
|
sanitizeRichText('<a href="https://example.com" target="_top" rel="me nofollow">x</a>'),
|
|
'<a href="https://example.com" rel="nofollow">x</a>'
|
|
)
|
|
})
|
|
|
|
test('url fields allow relative and https urls, reject script schemes', ({ assert }) => {
|
|
assert.equal(sanitizeUrl('/en/about'), '/en/about')
|
|
assert.equal(sanitizeUrl('https://example.com/?a=1&b=2'), 'https://example.com/?a=1&b=2')
|
|
assert.equal(sanitizeUrl('mailto:hi@example.com'), 'mailto:hi@example.com')
|
|
assert.equal(sanitizeUrl('javascript:alert(1)'), '')
|
|
assert.equal(sanitizeUrl(' jav\tascript:alert(1)'), '')
|
|
})
|
|
|
|
test('payload pass applies the url policy to known url keys only', ({ assert }) => {
|
|
assert.deepEqual(
|
|
sanitizePayload({
|
|
title: '<b>Hello</b>',
|
|
externalUrl: 'javascript:alert(1)',
|
|
items: [{ url: 'https://example.com/?a=1&b=2' }],
|
|
}),
|
|
{
|
|
title: '<b>Hello</b>',
|
|
externalUrl: '',
|
|
items: [{ url: 'https://example.com/?a=1&b=2' }],
|
|
}
|
|
)
|
|
})
|
|
})
|