'), false)
+test('the Go cases in upper case are neutralized', () => {
+ for (const [name, html] of GO_CASES) assertNeutralized(html.toUpperCase(), `${name} upper`)
})
-test('headings, tables, footnotes and links are safe and pass unchanged', () => {
- const safe = [
- 'Hello
',
- '',
- 'See footnote.
',
- 'Artykuły 
',
+test('comments are dropped; a comment is not content, so the input still counts as safe', () => {
+ const html = 'keep
'
+ assert.equal(sanitizeJournalHtml(html), 'keep
')
+ assert.deepEqual(gateJournalHtml(html), { safe: true, html: 'keep
' })
+})
+
+test('unsafe parts are removed, not the whole value', () => {
+ assert.equal(sanitizeJournalHtml('Before
After
'), 'Before
After
')
+ assert.equal(sanitizeJournalHtml('
tekst
'), ' tekst
')
+ assert.equal(sanitizeJournalHtml('link'), 'link')
+})
+
+test('text that names a scheme is ordinary text (WR-01)', () => {
+ const texts = [
+ 'Data: 12 maja 2024
',
+ 'Data publikacji: 3 czerwca 2025
',
+ 'The metadata: title, author and date.
',
+ 'Big data: what it means. JavaScript: a language. vbscript: legacy.
',
]
- for (const html of safe) {
+ for (const html of texts) {
+ assert.equal(sanitizeJournalHtml(html), html)
assert.equal(isSafeJournalHtml(html), true, html)
assert.deepEqual(gateJournalHtml(html), { safe: true, html })
}
})
-test('words starting with "on" are not handlers without an =', () => {
- assert.equal(isSafeJournalHtml('one of the onions
'), true)
+// The author footer of an imported post (post 64), without its \n
`
+ const out = sanitizeJournalHtml(html)
+ assert.equal(isSafeJournalHtml(html), false)
+ assert.doesNotMatch(out, /`)
+})
+
+test('inline styles keep only the four allowed properties with valid values', () => {
+ assert.equal(
+ sanitizeJournalHtml('x
'),
+ 'x
',
+ )
+ assert.equal(sanitizeJournalHtml('x
'), 'x
')
+ assert.equal(sanitizeJournalHtml('x
'), 'x
')
+ assert.equal(sanitizeJournalHtml('x
'), 'x
')
+})
+
+test('goldmark markup passes whole: headings, tables, footnotes, links and images', () => {
+ const safe = [
+ 'Hello
',
+ '',
+ 'See footnote.
',
+ '',
+ 'Artykuły
',
+ 'mail cdn page
',
+ 'Quote
',
+ 'one of the onions
',
+ ]
+ for (const html of safe) {
+ assert.equal(sanitizeJournalHtml(html), html)
+ assert.deepEqual(gateJournalHtml(html), { safe: true, html })
+ }
+})
+
+test('pasted chat transcripts keep dir="auto" and the two data attributes only', () => {
+ const html = 'Hi
'
+ assert.equal(sanitizeJournalHtml(html), html)
+ assert.equal(
+ sanitizeJournalHtml('Hi
'),
+ 'Hi
',
+ )
+})
+
+test('attribute values must match their patterns', () => {
+ assert.equal(sanitizeJournalHtml('x
'), 'x
')
+ assert.equal(sanitizeJournalHtml('x
'), 'x
')
+ assert.equal(sanitizeJournalHtml('x'), 'x')
+ assert.equal(sanitizeJournalHtml('x | '), 'x | ')
+ assert.equal(sanitizeJournalHtml('x'), 'x')
+ assert.equal(sanitizeJournalHtml('x'), 'x')
+})
+
+test('attribute and tag names from Object.prototype find no rule', () => {
+ assert.equal(
+ sanitizeJournalHtml('xt'),
+ 'xt',
+ )
+})
+
+test('sanitizing is idempotent, so server and client agree on a sanitized body', () => {
+ const inputs = [AUTHOR_FOOTER, ...REVIEW_BYPASSES.map(([, html]) => html), ...GO_CASES.map(([, html]) => html)]
+ for (const html of inputs) {
+ const once = sanitizeJournalHtml(html)
+ assert.equal(sanitizeJournalHtml(once), once, html)
+ }
})
test('empty input is safe and empty', () => {
for (const html of [null, undefined, '']) {
+ assert.equal(sanitizeJournalHtml(html), '')
assert.equal(isSafeJournalHtml(html), true)
assert.deepEqual(gateJournalHtml(html), { safe: true, html: '' })
}