mirror of https://github.com/requarks/wiki
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
60 lines
2.6 KiB
60 lines
2.6 KiB
const renderer = require('../../../modules/rendering/html-security/renderer')
|
|
|
|
describe('modules/rendering/html-security', () => {
|
|
const config = {
|
|
safeHTML: true,
|
|
allowDrawIoUnsafe: false,
|
|
allowIFrames: false
|
|
}
|
|
|
|
it('keeps the slot directives emitted by the tabset renderer', async () => {
|
|
const input = '<tabset><template v-slot:tabs=""><li>Tab</li></template>' +
|
|
'<template v-slot:content=""><div class="tabset-panel"><p>Content</p></div></template></tabset>'
|
|
const result = await renderer.init(input, config)
|
|
expect(result).toEqual(input)
|
|
})
|
|
|
|
it('strips the value of v-slot:tabs so it cannot be compiled as an expression', async () => {
|
|
const input = `<tabset><template v-slot:tabs="{x = constructor.constructor('alert(1)')()}"><li>Tab</li></template></tabset>`
|
|
const result = await renderer.init(input, config)
|
|
expect(result).toEqual('<tabset><template v-slot:tabs=""><li>Tab</li></template></tabset>')
|
|
})
|
|
|
|
it('strips the value of v-slot:content so it cannot be compiled as an expression', async () => {
|
|
const input = `<tabset><template v-slot:content="{x = constructor.constructor('alert(1)')()}"><div>Content</div></template></tabset>`
|
|
const result = await renderer.init(input, config)
|
|
expect(result).toEqual('<tabset><template v-slot:content=""><div>Content</div></template></tabset>')
|
|
})
|
|
|
|
it('strips the value of v-pre', async () => {
|
|
const result = await renderer.init(`<p v-pre="{{ constructor.constructor('alert(1)')() }}">Text</p>`, config)
|
|
expect(result).toEqual('<p v-pre="">Text</p>')
|
|
})
|
|
|
|
it('removes any other directive or binding attribute', async () => {
|
|
const inputs = [
|
|
`<div v-html="'<img src=x onerror=alert(1)>'">Text</div>`,
|
|
`<div :class="constructor.constructor('alert(1)')()">Text</div>`,
|
|
`<div v-bind:class="constructor.constructor('alert(1)')()">Text</div>`,
|
|
`<div @click="alert(1)">Text</div>`,
|
|
`<div v-on:click="alert(1)">Text</div>`,
|
|
`<div v-slot="{x = alert(1)}">Text</div>`
|
|
]
|
|
for (const input of inputs) {
|
|
expect(await renderer.init(input, config)).toEqual('<div>Text</div>')
|
|
}
|
|
})
|
|
|
|
it('leaves regular content attributes untouched', async () => {
|
|
const input = '<a href="/foo" target="_blank" title="Foo" data-id="1">Link</a>'
|
|
const result = await renderer.init(input, config)
|
|
expect(result).toEqual(input)
|
|
})
|
|
|
|
it('does not sanitize anything when safeHTML is disabled', async () => {
|
|
const input = `<tabset><template v-slot:tabs="{x = alert(1)}"><li>Tab</li></template></tabset>`
|
|
const result = await renderer.init(input, { ...config, safeHTML: false })
|
|
expect(result).toEqual(input)
|
|
})
|
|
})
|