1package systemviews
2
3import (
4 "testing"
5
6 "github.com/bnema/dumber/internal/domain/entity"
7 "github.com/stretchr/testify/assert"
8 "github.com/stretchr/testify/require"
9)
10
11func TestHistoryHTMLSanitizesHrefSchemes(t *testing.T) {
12 t.Parallel()
13
14 html := historyHTML(historyRenderData{Entries: []*entity.HistoryEntry{
15 {URL: "javascript:alert(1)", Title: "Bad"},
16 {URL: "https://example.com", Title: "Good"},
17 }})
18
19 require.NotContains(t, html, `href="javascript:alert(1)"`)
20 assert.Contains(t, html, `href="#"`)
21 assert.Contains(t, html, `href="https://example.com"`)
22}
23
24func TestFavoriteItemsHTMLSanitizesHrefSchemes(t *testing.T) {
25 t.Parallel()
26
27 html := favoritesHTML(favoritesRenderData{Favorites: []*entity.Favorite{
28 {URL: "javascript:alert(1)", Title: "Bad"},
29 {URL: "https://example.com", Title: "Good"},
30 }})
31
32 require.NotContains(t, html, `href="javascript:alert(1)"`)
33 assert.Contains(t, html, `href="#"`)
34 assert.Contains(t, html, `href="https://example.com"`)
35}
36
37func TestSanitizeHrefRejectsNetworkPathAndMalformedHTTP(t *testing.T) {
38 t.Parallel()
39
40 assert.Equal(t, "#", sanitizeHref("///evil.com"))
41 assert.Equal(t, "#", sanitizeHref("//evil.com"))
42 assert.Equal(t, "#", sanitizeHref("https:///evil.com"))
43 assert.Equal(t, "#", sanitizeHref("http:evil.com"))
44 assert.Equal(t, "https://example.com", sanitizeHref("https://example.com"))
45 assert.Equal(t, "https://example.com/path", sanitizeHref("https://user:pass@example.com/path"))
46}
47
48func TestSanitizeHrefAllowsInternalDumbRoutes(t *testing.T) {
49 t.Parallel()
50
51 assert.Equal(t, "dumb://history", sanitizeHref("dumb://history"))
52 assert.Equal(t, "dumb:history", sanitizeHref("dumb:history"))
53 assert.Equal(t, "#", sanitizeHref("dumb:///history"))
54}
55
56func TestFavoritesHTMLSanitizesTagColors(t *testing.T) {
57 t.Parallel()
58
59 html := favoritesHTML(favoritesRenderData{
60 Favorites: []*entity.Favorite{{ID: 1, URL: "https://example.com", Title: "Example"}},
61 Tags: []*entity.Tag{{ID: 7, Name: "Bad", Color: `red;background:url(javascript:alert(1))`}},
62 })
63
64 require.NotContains(t, html, `style="background:red`)
65 assert.Contains(t, html, "background:#808080")
66}