mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 12:22:14 +03:00
7c23dab64d
v3.8.40 cycle integration → main. All test gates green (Unit/Integration/Coverage/Node-compat/Quality-Ratchet). The only red check, 'PR Test Policy', is the test-masking heuristic firing on the cumulative ~57-commit release diff (legitimate assert consolidations already reviewed per-PR — Gemini CLI removal #5246, retired GPT models #5280, provider catalog refreshes); overridden with --admin per the documented release-PR convention. CodeQL/SonarQube advisory scans non-blocking; #5278's code already passed CodeQL on main. Homologated on VPS 192.168.0.15 (v3.8.40 healthy).
28 lines
1.5 KiB
TypeScript
28 lines
1.5 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { sanitizeDocsHtml } from "../../../src/lib/docsSanitizer.ts";
|
|
|
|
test("sanitizeDocsHtml removes dangerous tags and attributes", () => {
|
|
const malicious = '<script>alert("xss")</script><img src="x" onerror="alert(1)"> <a href="javascript:alert(1)">link</a> <div onclick="evil()">content</div>';
|
|
const sanitized = sanitizeDocsHtml(malicious);
|
|
|
|
assert.ok(!sanitized.includes("<script>"), "Should remove <script>");
|
|
assert.ok(!sanitized.includes("onerror"), "Should remove onerror");
|
|
assert.ok(!sanitized.includes("onclick"), "Should remove onclick");
|
|
assert.ok(!sanitized.includes("javascript:"), "Should remove javascript: URLs");
|
|
assert.ok(sanitized.includes("<a>link</a>") || sanitized.includes("<a >link</a>") || sanitized.includes("link"), "Should keep safe content");
|
|
});
|
|
|
|
test("sanitizeDocsHtml allows safe tags and attributes", () => {
|
|
const safe = '<h1>Title</h1><p>Paragraph with <strong>bold</strong> and <em>italic</em>.</p><ul><li>Item</li></ul><pre><code>code</code></pre>';
|
|
const sanitized = sanitizeDocsHtml(safe);
|
|
|
|
assert.ok(sanitized.includes("<h1>Title</h1>"), "Should allow <h1>");
|
|
assert.ok(sanitized.includes("<p>"), "Should allow <p>");
|
|
assert.ok(sanitized.includes("<strong>"), "Should allow <strong>");
|
|
assert.ok(sanitized.includes("<ul>"), "Should allow <ul>");
|
|
assert.ok(sanitized.includes("<li>"), "Should allow <li>");
|
|
assert.ok(sanitized.includes("<pre>"), "Should allow <pre>");
|
|
assert.ok(sanitized.includes("<code>"), "Should allow <code>");
|
|
});
|