2019-01-27 16:12:17 +01:00
|
|
|
/* eslint-env jest */
|
|
|
|
// These tests are based on https://github.com/zertosh/htmlescape/blob/3e6cf0614dd0f778fd0131e69070b77282150c15/test/htmlescape-test.js
|
|
|
|
// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE
|
2019-02-19 22:45:07 +01:00
|
|
|
import { htmlEscapeJsonString } from 'next/dist/server/htmlescape'
|
2019-01-27 16:12:17 +01:00
|
|
|
import vm from 'vm'
|
|
|
|
|
|
|
|
describe('htmlescape', () => {
|
|
|
|
test('with angle brackets should escape', () => {
|
2019-02-19 22:45:07 +01:00
|
|
|
const evilObj = { evil: '<script></script>' }
|
2019-05-30 03:19:32 +02:00
|
|
|
expect(htmlEscapeJsonString(JSON.stringify(evilObj))).toBe(
|
|
|
|
'{"evil":"\\u003cscript\\u003e\\u003c/script\\u003e"}'
|
|
|
|
)
|
2019-01-27 16:12:17 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
test('with angle brackets should parse back', () => {
|
2019-02-19 22:45:07 +01:00
|
|
|
const evilObj = { evil: '<script></script>' }
|
2019-05-30 03:19:32 +02:00
|
|
|
expect(
|
|
|
|
JSON.parse(htmlEscapeJsonString(JSON.stringify(evilObj)))
|
|
|
|
).toMatchObject(evilObj)
|
2019-01-27 16:12:17 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
test('with ampersands should escape', () => {
|
2019-02-19 22:45:07 +01:00
|
|
|
const evilObj = { evil: '&' }
|
2019-05-30 03:19:32 +02:00
|
|
|
expect(htmlEscapeJsonString(JSON.stringify(evilObj))).toBe(
|
|
|
|
'{"evil":"\\u0026"}'
|
|
|
|
)
|
2019-01-27 16:12:17 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
test('with ampersands should parse back', () => {
|
2019-02-19 22:45:07 +01:00
|
|
|
const evilObj = { evil: '&' }
|
2019-05-30 03:19:32 +02:00
|
|
|
expect(
|
|
|
|
JSON.parse(htmlEscapeJsonString(JSON.stringify(evilObj)))
|
|
|
|
).toMatchObject(evilObj)
|
2019-01-27 16:12:17 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
test('with "LINE SEPARATOR" and "PARAGRAPH SEPARATOR" should escape', () => {
|
2019-02-19 22:45:07 +01:00
|
|
|
const evilObj = { evil: '\u2028\u2029' }
|
2019-05-30 03:19:32 +02:00
|
|
|
expect(htmlEscapeJsonString(JSON.stringify(evilObj))).toBe(
|
|
|
|
'{"evil":"\\u2028\\u2029"}'
|
|
|
|
)
|
2019-01-27 16:12:17 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
test('with "LINE SEPARATOR" and "PARAGRAPH SEPARATOR" should parse back', () => {
|
2019-02-19 22:45:07 +01:00
|
|
|
const evilObj = { evil: '\u2028\u2029' }
|
2019-05-30 03:19:32 +02:00
|
|
|
expect(
|
|
|
|
JSON.parse(htmlEscapeJsonString(JSON.stringify(evilObj)))
|
|
|
|
).toMatchObject(evilObj)
|
2019-01-27 16:12:17 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
test('escaped line terminators should work', () => {
|
|
|
|
expect(() => {
|
2019-05-30 03:19:32 +02:00
|
|
|
vm.runInNewContext(
|
|
|
|
'(' +
|
|
|
|
htmlEscapeJsonString(JSON.stringify({ evil: '\u2028\u2029' })) +
|
|
|
|
')'
|
|
|
|
)
|
2019-01-27 16:12:17 +01:00
|
|
|
}).not.toThrow()
|
|
|
|
})
|
|
|
|
})
|