toor
1e9ea89d86
Import the client, server, skills, tests, and build scripts as the starting point for the rebuild, then trim the surfaces this project does not ship: Electron desktop packaging, the marketing website, and the ESP32 firmware tree. CI keeps the web build, e2e, lockfile, release, and Docker workflows. Rename the package and CLI entry points to hermes-ui, drop the prepare hook so npm ci no longer triggers a build, and drop the removed tsconfig and nodemon references. Rewrite AGENTS.md, ARCHITECTURE.md, DEVELOPMENT.md, and the READMEs so the documented package map and hard rules match this repository. reference_code/ is ignored: it is a read-only snapshot, not an input to the build.
59 lines
1.9 KiB
TypeScript
59 lines
1.9 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
|
|
import { renderHighlightedCodeBlock } from '@/components/hermes/chat/highlight'
|
|
|
|
const DIFF_WITH_HTML = `diff --git a/foo.html b/foo.html
|
|
--- a/foo.html
|
|
+++ b/foo.html
|
|
@@ -1 +1 @@
|
|
-<script>alert(1)</script>
|
|
+<img src=x onerror=alert(1)>
|
|
`
|
|
|
|
describe('highlight safety', () => {
|
|
it('escapes large unknown code content', () => {
|
|
const html = renderHighlightedCodeBlock('<img src=x onerror=alert(1)>'.repeat(100), 'unknown', 'Copy')
|
|
|
|
expect(html).toContain('<img')
|
|
expect(html).not.toContain('<img')
|
|
})
|
|
|
|
it('does not emit executable HTML for known-language code', () => {
|
|
const html = renderHighlightedCodeBlock('<script>alert(1)</script>', 'xml', 'Copy')
|
|
|
|
expect(html).not.toContain('<script>')
|
|
expect(html).toContain('<')
|
|
})
|
|
|
|
it('escapes the language label', () => {
|
|
const html = renderHighlightedCodeBlock('x'.repeat(5000), '<script>alert(1)</script>', 'Copy')
|
|
|
|
expect(html).toContain('<script>alert(1)</script>')
|
|
expect(html).not.toContain('<script>')
|
|
})
|
|
|
|
it('sanitizes the language class', () => {
|
|
const html = renderHighlightedCodeBlock('x'.repeat(5000), 'foo bar"><img', 'Copy')
|
|
|
|
expect(html).toContain('language-foo-bar---img')
|
|
})
|
|
|
|
it('escapes the copy label', () => {
|
|
const html = renderHighlightedCodeBlock('x', 'json', 'Copy <now>')
|
|
|
|
expect(html).toContain('Copy <now>')
|
|
expect(html).not.toContain('Copy <now>')
|
|
})
|
|
|
|
it('escapes executable HTML inside unified diff rendering', () => {
|
|
const html = renderHighlightedCodeBlock(DIFF_WITH_HTML, undefined, 'Copy')
|
|
|
|
expect(html).toContain('diff-line diff-line-added')
|
|
expect(html).toContain('diff-line diff-line-removed')
|
|
expect(html).not.toContain('<script>')
|
|
expect(html).not.toContain('<img')
|
|
expect(html).toContain('<script>alert(1)</script>')
|
|
expect(html).toContain('<img src=x onerror=alert(1)>')
|
|
})
|
|
})
|