TASKS-1823 WebManager module

2026-08-28 08:35:58 +00:00
parent fdb2cf3837
commit c93d8c025b
654 changed files with 26232 additions and 6075 deletions
@@ -0,0 +1,56 @@
+import { test } from '@japa/runner'
+import {
+  sanitizePayload,
+  sanitizeRichText,
+  sanitizeUrl,
+} from '#base_modules/WebManager/services/content_sanitizer'
+
+test.group('Web Manager content sanitizer', () => {
+  test('rich text keeps allowed markup and drops event handlers', ({ assert }) => {
+    assert.equal(
+      sanitizeRichText('<p class="lead" onclick="alert(1)">Hi <em>there</em></p>'),
+      '<p class="lead">Hi <em>there</em></p>'
+    )
+  })
+
+  test('rich text drops dangerous subtrees entirely', ({ assert }) => {
+    assert.equal(
+      sanitizeRichText('before<script>alert(1)</script><svg><a onload="alert(1)"></a></svg>after'),
+      'beforeafter'
+    )
+  })
+
+  test('rich text rejects unsafe link schemes and normalizes rel', ({ assert }) => {
+    assert.equal(
+      sanitizeRichText('<a href="javascript:alert(1)" target="_blank" rel="me nofollow">x</a>'),
+      '<a target="_blank" rel="noopener noreferrer">x</a>'
+    )
+    assert.equal(
+      sanitizeRichText('<a href="https://example.com" target="_top" rel="me nofollow">x</a>'),
+      '<a href="https://example.com" rel="nofollow">x</a>'
+    )
+  })
+
+  test('url fields allow relative and https urls, reject script schemes', ({ assert }) => {
+    assert.equal(sanitizeUrl('/en/about'), '/en/about')
+    assert.equal(sanitizeUrl('https://example.com/?a=1&b=2'), 'https://example.com/?a=1&b=2')
+    assert.equal(sanitizeUrl('mailto:hi@example.com'), 'mailto:hi@example.com')
+    assert.equal(sanitizeUrl('javascript:alert(1)'), '')
+    assert.equal(sanitizeUrl(' jav\tascript:alert(1)'), '')
+  })
+
+  test('payload pass applies the url policy to known url keys only', ({ assert }) => {
+    assert.deepEqual(
+      sanitizePayload({
+        title: '<b>Hello</b>',
+        externalUrl: 'javascript:alert(1)',
+        items: [{ url: 'https://example.com/?a=1&b=2' }],
+      }),
+      {
+        title: '<b>Hello</b>',
+        externalUrl: '',
+        items: [{ url: 'https://example.com/?a=1&b=2' }],
+      }
+    )
+  })
+})