73 lines
2.2 KiB
JavaScript
73 lines
2.2 KiB
JavaScript
const { escapeSvg, safeColor } = require('../src/lib/sanitize');
|
|
|
|
describe('sanitize', () => {
|
|
|
|
describe('escapeSvg', () => {
|
|
it('should escape < and >', () => {
|
|
expect(escapeSvg('<script>')).toBe('<script>');
|
|
});
|
|
|
|
it('should escape &', () => {
|
|
expect(escapeSvg('A & B')).toBe('A & B');
|
|
});
|
|
|
|
it('should escape double quotes', () => {
|
|
expect(escapeSvg('"hello"')).toBe('"hello"');
|
|
});
|
|
|
|
it('should escape single quotes', () => {
|
|
expect(escapeSvg("it's")).toBe('it's');
|
|
});
|
|
|
|
it('should escape combined special characters', () => {
|
|
expect(escapeSvg('<img src="x" onerror=\'alert(1)\'>')).toBe(
|
|
'<img src="x" onerror='alert(1)'>'
|
|
);
|
|
});
|
|
|
|
it('should pass through normal text unchanged', () => {
|
|
expect(escapeSvg('Hello World')).toBe('Hello World');
|
|
expect(escapeSvg('test-123')).toBe('test-123');
|
|
});
|
|
|
|
it('should handle numbers by converting to string', () => {
|
|
expect(escapeSvg(42)).toBe('42');
|
|
});
|
|
|
|
it('should handle empty string', () => {
|
|
expect(escapeSvg('')).toBe('');
|
|
});
|
|
});
|
|
|
|
describe('safeColor', () => {
|
|
it('should accept hex colors', () => {
|
|
expect(safeColor('#fff')).toBe('#fff');
|
|
expect(safeColor('#FF0000')).toBe('#FF0000');
|
|
expect(safeColor('#12345678')).toBe('#12345678');
|
|
});
|
|
|
|
it('should accept named colors', () => {
|
|
expect(safeColor('red')).toBe('red');
|
|
expect(safeColor('blue')).toBe('blue');
|
|
expect(safeColor('none')).toBe('none');
|
|
expect(safeColor('transparent')).toBe('transparent');
|
|
});
|
|
|
|
it('should return fallback for invalid colors', () => {
|
|
expect(safeColor('javascript:alert(1)')).toBe('#000000');
|
|
expect(safeColor('rgb(255,0,0)')).toBe('#000000');
|
|
expect(safeColor('url(evil)')).toBe('#000000');
|
|
});
|
|
|
|
it('should use custom fallback for non-alphabetic invalid values', () => {
|
|
expect(safeColor('rgb(255,0,0)', '#fff')).toBe('#fff');
|
|
expect(safeColor('url(evil)', 'none')).toBe('none');
|
|
});
|
|
|
|
it('should return default fallback (#000000) when not specified', () => {
|
|
expect(safeColor('')).toBe('#000000');
|
|
expect(safeColor('999')).toBe('#000000');
|
|
});
|
|
});
|
|
});
|