| 1 | package credits |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "html/template" |
| 6 | "strings" |
| 7 | "testing" |
| 8 | ) |
| 9 | |
| 10 | func TestNoticesAreEscapedAndNeedNoScript(t *testing.T) { |
| 11 | tpl, err := template.ParseFS(Templates(), "templates/*.html") |
| 12 | if err != nil { |
| 13 | t.Fatal(err) |
| 14 | } |
| 15 | notice := "Copyright <script>alert(1)</script>\nPermission & conditions" |
| 16 | data := PageData{Title: "Open source", Components: []Component{{Name: "<img src=x onerror=alert(1)>", Version: "v1.2.3", SourceURL: "https://example.org/source", Notices: []Notice{{Name: "LICENSE", Text: notice}}}}} |
| 17 | var out bytes.Buffer |
| 18 | if err := tpl.ExecuteTemplate(&out, "estilo/credits", data); err != nil { |
| 19 | t.Fatal(err) |
| 20 | } |
| 21 | html := out.String() |
| 22 | if strings.Contains(html, "<script") || strings.Contains(html, "<img") || !strings.Contains(html, "<details>") || !strings.Contains(html, "<script>") || !strings.Contains(html, "Permission & conditions") { |
| 23 | t.Fatal("notices were interpreted as markup or lost") |
| 24 | } |
| 25 | data.Components[0].SourceURL = "javascript:alert(1)" |
| 26 | out.Reset() |
| 27 | if err := tpl.ExecuteTemplate(&out, "estilo/credits", data); err != nil { |
| 28 | t.Fatal(err) |
| 29 | } |
| 30 | if strings.Contains(out.String(), `href="javascript:`) { |
| 31 | t.Fatal("unsafe source URL reached link") |
| 32 | } |
| 33 | } |
| 34 | |
| 35 | func TestCallerSuppliesLocalizedTitleAndNoticesRemainOriginal(t *testing.T) { |
| 36 | tpl, err := template.ParseFS(Templates(), "templates/*.html") |
| 37 | if err != nil { |
| 38 | t.Fatal(err) |
| 39 | } |
| 40 | // The component has no translated strings of its own. Even a right-to-left |
| 41 | // title leaves package identifiers isolated and notice text unchanged. |
| 42 | for _, title := range []string{"Open source", "Foinse oscailte", "Código abierto", "Code source ouvert", "Código aberto", "Open source-software", "Openbronsoftware", "Codice aperto", "Kod źródłowy", "Öppen källkod", "オープンソース", "المصدر المفتوح"} { |
| 43 | var out bytes.Buffer |
| 44 | if err := tpl.ExecuteTemplate(&out, "estilo/credits", PageData{Title: title, Components: []Component{{Name: "example/module", Notices: []Notice{{Name: "LICENSE", Text: "Original notice"}}}}}); err != nil { |
| 45 | t.Fatal(err) |
| 46 | } |
| 47 | if !strings.Contains(out.String(), title) || !strings.Contains(out.String(), "Original notice") || !strings.Contains(out.String(), "<bdi>example/module</bdi>") { |
| 48 | t.Fatal("localized title or original notice lost") |
| 49 | } |
| 50 | } |
| 51 | } |
| 52 | |
| 53 | func TestNoticeFormattingAndMissingLabel(t *testing.T) { |
| 54 | tpl := template.Must(template.ParseFS(Templates(), "templates/*.html")) |
| 55 | var out bytes.Buffer |
| 56 | data := PageData{Title: "Credits", MissingNoticeLabel: "<missing>", Components: []Component{{Name: "first", Notices: []Notice{{Name: "LICENSE", Text: "\nOriginal notice"}}}, {Name: "second"}}} |
| 57 | if err := tpl.ExecuteTemplate(&out, "estilo/credits", data); err != nil { |
| 58 | t.Fatal(err) |
| 59 | } |
| 60 | html := out.String() |
| 61 | if !strings.Contains(html, "<pre>\n\nOriginal notice</pre>") { |
| 62 | t.Fatal("HTML parser would remove original first newline") |
| 63 | } |
| 64 | if strings.Contains(html, "<h2>") { |
| 65 | t.Fatal("notice filename became an unowned heading") |
| 66 | } |
| 67 | if strings.Count(html, "<missing>") != 1 || strings.Contains(html, "<missing>") { |
| 68 | t.Fatal("missing-notice label lost, repeated or interpreted") |
| 69 | } |
| 70 | } |
| 71 | |
amadan