Jakub Zych
294a8d8b19
- body sanitized with its safe text kept, source, translations and related post bodies out of the payload, null body as an empty string
56 lines
1.9 KiB
TypeScript
56 lines
1.9 KiB
TypeScript
// The post page's payload: the body is sanitized, never blanked, and the raw
|
|
// source, translations and related post bodies stay out of it.
|
|
import { test } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { toPostView } from '../app/utils/postView.ts'
|
|
import type { JournalPost, JournalPostDetail } from '../app/utils/types.ts'
|
|
|
|
function post(overrides: Partial<JournalPost> = {}): JournalPost {
|
|
return {
|
|
id: 1,
|
|
title: 'Hello',
|
|
slug: 'hello',
|
|
excerpt: null,
|
|
content: 'source',
|
|
content_html: '<p>Hello</p>',
|
|
reading_time: 1,
|
|
published: true,
|
|
published_at: '2026-01-01T00:00:00+00:00',
|
|
is_pinned: false,
|
|
metadata: null,
|
|
sources: null,
|
|
author: null,
|
|
categories: [],
|
|
tags: [],
|
|
featured_images: [],
|
|
featured_image_url: null,
|
|
translations: { en: { title: 'Hello' } },
|
|
created_at: null,
|
|
updated_at: null,
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
function detail(overrides: Partial<JournalPostDetail> = {}): JournalPostDetail {
|
|
return { ...post(), previous_post: null, next_post: null, related_posts: [], ...overrides }
|
|
}
|
|
|
|
test('the body is sanitized and the safe parts are kept', () => {
|
|
const view = toPostView(detail({ content_html: '<p>Data: 12 maja 2024</p><script>alert(1)</script><p>After</p>' }))
|
|
assert.equal(view.content_html, '<p>Data: 12 maja 2024</p><p>After</p>')
|
|
})
|
|
|
|
test('source, translations and related post bodies stay out of the payload', () => {
|
|
const view = toPostView(detail({ related_posts: [post({ id: 2, slug: 'other' })] }))
|
|
assert.equal(view.content, null)
|
|
assert.equal(view.translations, null)
|
|
assert.equal(view.related_posts.length, 1)
|
|
assert.equal(view.related_posts[0]!.content_html, null)
|
|
assert.equal(view.related_posts[0]!.content, null)
|
|
assert.equal(view.related_posts[0]!.translations, null)
|
|
})
|
|
|
|
test('a missing body becomes an empty string', () => {
|
|
assert.equal(toPostView(detail({ content_html: null })).content_html, '')
|
|
})
|