test/utils.test.ts (2)

51-56: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider verifying exact escaped output for duck-typed objects.

Because String({ value: "..." }) evaluates to "[object Object]", the current test correctly asserts that not.toContain("<script>") passes, but it doesn't explicitly prove that the malicious string itself is escaped. Adding a toString() method to the spoofed object ensures the content is serialized into the template, allowing you to explicitly verify that <script> was safely output.

♻️ Proposed refactor for a more rigorous assertion

    it("does not treat duck-typed objects as raw values", async () => {
-     const spoofed = { value: "<script>alert(1)</script>" };
+     const spoofed = { 
+       value: "<script>alert(1)</script>",
+       toString() { return this.value; }
+     };
      t.app.get("/test", () => html`<div>${spoofed}</div>`);
      const res = await t.fetch("/test");
-     expect(await res.text()).not.toContain("<script>");
+     expect(await res.text()).toBe("<div>&lt;script&gt;alert(1)&lt;/script&gt;</div>");
    });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/utils.test.ts` around lines 51 - 56, Strengthen the duck-typed object
test around the spoofed value in “does not treat duck-typed objects as raw
values” by adding a toString() implementation that returns the malicious markup,
then assert the response contains its escaped representation (<script>)
rather than only asserting the raw tag is absent.

---

58-86: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Prevent test pollution from mutated module state.

The tests reset (html as any)._isWarned = false but do not restore it after execution. Since the second test doesn't trigger the warning, it leaves _isWarned as false. If any subsequent test elsewhere in the file passes an unescaped string to html(...), it will unexpectedly log the warning to the console because console.warn is no longer mocked.

Consider capturing the original value of _isWarned and restoring it in the finally block.

♻️ Proposed fixes to restore state

    it("escapes plain string usage and warns once", async () => {
+     const originalWarned = (html as { _isWarned?: boolean })._isWarned;
      (html as { _isWarned?: boolean })._isWarned = false;
      const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
      try {
        t.app.get("/test", () => html("<p>raw & <string></p>"));
        const res = await t.fetch("/test");
        expect(await res.text()).toBe("&lt;p&gt;raw &amp; &lt;string&gt;&lt;/p&gt;");
        expect(warnSpy).toHaveBeenCalledTimes(1);
        expect(warnSpy.mock.calls[0][0]).toContain("html``");

        const res2 = await t.fetch("/test");
        expect(await res2.text()).toBe("&lt;p&gt;raw &amp; &lt;string&gt;&lt;/p&gt;");
        expect(warnSpy).toHaveBeenCalledTimes(1);
      } finally {
        warnSpy.mockRestore();
+       (html as { _isWarned?: boolean })._isWarned = originalWarned;
      }
    });

    it("does not warn for plain strings without special characters", async () => {
+     const originalWarned = (html as { _isWarned?: boolean })._isWarned;
      (html as { _isWarned?: boolean })._isWarned = false;
      const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
      try {
        t.app.get("/test", () => html("Hello, World!"));
        const res = await t.fetch("/test");
        expect(await res.text()).toBe("Hello, World!");
        expect(warnSpy).not.toHaveBeenCalled();
      } finally {
        warnSpy.mockRestore();
+       (html as { _isWarned?: boolean })._isWarned = originalWarned;
      }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/utils.test.ts` around lines 58 - 86, Update both tests around the html
warning behavior to capture the original html._isWarned value before resetting
it, then restore that value in each existing finally block after restoring
console.warn. Keep the current assertions and warning-spy behavior unchanged.