41 lines
1.5 KiB
TypeScript
41 lines
1.5 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import {
|
|
normalizeExtraRichText,
|
|
sanitizeRichTextHtml,
|
|
sanitizeRichTextUrl,
|
|
} from "@/lib/rich-text";
|
|
|
|
describe("rich text sanitization", () => {
|
|
it("keeps supported formatting, colors, and safe links", () => {
|
|
expect(sanitizeRichTextHtml(
|
|
'<p><strong>Good</strong> <span style="color: #ff3b30">news</span> <a href="https://example.com" onclick="bad()">link</a></p>',
|
|
)).toBe(
|
|
'<p><strong>Good</strong> <span style="color: #FF3B30">news</span> <a href="https://example.com" target="_blank" rel="noopener noreferrer">link</a></p>',
|
|
);
|
|
});
|
|
|
|
it("removes executable markup, unsafe links, and unsupported styles", () => {
|
|
expect(sanitizeRichTextHtml(
|
|
'<script>alert(1)</script><p onclick="bad()">Safe <span style="background:red;color:red">text</span><a href="javascript:bad()">link</a></p>',
|
|
)).toBe("<p>Safe <span>text</span><a>link</a></p>");
|
|
expect(sanitizeRichTextUrl("data:text/html,bad")).toBe("");
|
|
});
|
|
});
|
|
|
|
describe("legacy Extra rich text conversion", () => {
|
|
it("escapes plain text, preserves newlines, and converts phrase colors", () => {
|
|
expect(normalizeExtraRichText("<unsafe>\nMASSIVE damage", [
|
|
{ text: "MASSIVE", color: "#ff0000" },
|
|
])).toBe(
|
|
'<p><unsafe><br><span style="color: #FF0000">MASSIVE</span> damage</p>',
|
|
);
|
|
});
|
|
|
|
it("leaves sanitized rich text in rich-text form", () => {
|
|
expect(normalizeExtraRichText('<p><em>Ready</em></p>', [
|
|
{ text: "Ready", color: "#ff0000" },
|
|
])).toBe("<p><em>Ready</em></p>");
|
|
});
|
|
});
|