|
| 1 | +import { baseUrl } from 'marked-base-url'; |
| 2 | +import { describe, expect, test } from 'vitest'; |
| 3 | +import { Markdown } from './markdown'; |
| 4 | + |
| 5 | +// add a random extension to the instance |
| 6 | +const instance = Markdown.create(baseUrl('https://unraid.net')); |
| 7 | +const parse = async (content: string) => ({ |
| 8 | + fromDefault: await Markdown.parse(content), |
| 9 | + fromInstance: await instance.parse(content), |
| 10 | +}); |
| 11 | + |
| 12 | +describe('sanitization', () => { |
| 13 | + test('strips javascript', async () => { |
| 14 | + const parsed = await parse(`<img src=x onerror=alert(1)//><script>console.log('hello')</script>`); |
| 15 | + expect(parsed.fromDefault).toMatchSnapshot(); |
| 16 | + expect(parsed.fromInstance).toMatchSnapshot(); |
| 17 | + }); |
| 18 | + |
| 19 | + test('strips various XSS vectors', async () => { |
| 20 | + const vectors = [ |
| 21 | + '<a href="javascript:alert(1)">click me</a>', |
| 22 | + "<IMG SRC=JaVaScRiPt:alert('XSS')>", |
| 23 | + '"><script>alert(document.cookie)</script>', |
| 24 | + '<style>@import \'javascript:alert("XSS")\';</style>', |
| 25 | + ]; |
| 26 | + |
| 27 | + for (const vector of vectors) { |
| 28 | + const parsed = await parse(vector); |
| 29 | + expect(parsed.fromDefault).not.toContain('javascript:'); |
| 30 | + expect(parsed.fromInstance).not.toContain('javascript:'); |
| 31 | + } |
| 32 | + }); |
| 33 | +}); |
| 34 | + |
| 35 | +describe('extensibility', () => { |
| 36 | + test('works with other extensions', async () => { |
| 37 | + const parsed = await parse(`[Contact](/contact)`); |
| 38 | + expect(parsed.fromDefault).toMatchInlineSnapshot(` |
| 39 | + "<p><a href="/contact">Contact</a></p> |
| 40 | + " |
| 41 | + `); |
| 42 | + expect(parsed.fromInstance).toMatchInlineSnapshot(` |
| 43 | + "<p><a href="https://unraid.net/contact">Contact</a></p> |
| 44 | + " |
| 45 | + `); |
| 46 | + }); |
| 47 | +}); |
0 commit comments