Claude Sonnet 5
b0d9a00c18
All checks were successful
CD / Build and push images (push) Successful in 1m50s
CI / Lint, typecheck, test (push) Successful in 1m23s
CI / Auth e2e pack (push) Successful in 1m42s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 8s
CD / Smoke tests against Test (push) Successful in 1m4s
CD / Promote to Int (push) Successful in 10s
The #24 commit passed ESLint but not the repo's Prettier check (pnpm lint runs both) — CI caught it after the push. Formatting only, no behavior change.
53 lines
2.1 KiB
TypeScript
53 lines
2.1 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
|
|
import { docToHtml } from './html';
|
|
import { markdownToDoc } from './markdown';
|
|
import { editorSchema } from './schema';
|
|
|
|
describe('docToHtml (issue #24)', () => {
|
|
it('escapes text content, including angle brackets and quotes', () => {
|
|
const doc = markdownToDoc('Contains <script>alert("x")</script> literally.');
|
|
const html = docToHtml(doc);
|
|
expect(html).not.toContain('<script>');
|
|
expect(html).toContain('<script>');
|
|
expect(html).toContain('"x"');
|
|
});
|
|
|
|
it('renders inline marks and a table', () => {
|
|
const doc = markdownToDoc('**bold** and *italic* and `code`');
|
|
expect(docToHtml(doc)).toBe(
|
|
'<p><strong>bold</strong> and <em>italic</em> and <code>code</code></p>',
|
|
);
|
|
|
|
const table = markdownToDoc('| A | B |\n| --- | --- |\n| 1 | 2 |');
|
|
expect(docToHtml(table)).toBe(
|
|
'<table><tr><th><p>A</p></th><th><p>B</p></th></tr><tr><td><p>1</p></td><td><p>2</p></td></tr></table>',
|
|
);
|
|
});
|
|
|
|
it('allowlists link protocols, neutralizing javascript: hrefs', () => {
|
|
const safe = markdownToDoc('[go](https://example.org)');
|
|
expect(docToHtml(safe)).toContain('href="https://example.org"');
|
|
|
|
// markdown-it itself already refuses to tokenize `javascript:` links
|
|
// (falls back to plain text), so the schema is built directly here to
|
|
// exercise docToHtml's own allowlist (security.md) independently of
|
|
// that upstream defense.
|
|
const linkMark = editorSchema.marks.link.create({ href: 'javascript:evil' });
|
|
const doc = editorSchema.node('doc', null, [
|
|
editorSchema.node('paragraph', null, [editorSchema.text('click me', [linkMark])]),
|
|
]);
|
|
const html = docToHtml(doc);
|
|
expect(html).not.toContain('javascript:');
|
|
expect(html).toContain('href="#"');
|
|
});
|
|
|
|
it('renders task list checkboxes with their checked state', () => {
|
|
const doc = markdownToDoc('- [ ] Todo\n- [x] Done');
|
|
const html = docToHtml(doc);
|
|
expect(html).toContain('data-checked="false"');
|
|
expect(html).toContain('data-checked="true"');
|
|
expect(html).toContain('<input type="checkbox" disabled checked>');
|
|
});
|
|
});
|