26 lines
1.0 KiB
TypeScript
26 lines
1.0 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import { defaultReview } from '../../src/domain/review';
|
|
import { buildRecord } from '../../src/analysis/record-builder';
|
|
import { buildDashboardHtml } from '../../src/exports/dashboard-export';
|
|
|
|
describe('dashboard export', () => {
|
|
it('escapes imported and reviewed values in the generated HTML', () => {
|
|
const record = buildRecord({
|
|
row: ['<img src=x onerror=alert(1)>', 'High'],
|
|
headers: ['Name', 'Severity'],
|
|
index: 0,
|
|
sheetName: 'Findings'
|
|
});
|
|
const html = buildDashboardHtml('<script>alert(1)</script>', [{
|
|
record,
|
|
sheetName: '<b>Sheet</b>',
|
|
review: { ...defaultReview(), owner: '<svg onload=alert(1)>' }
|
|
}], { now: () => new Date('2026-07-17T10:00:00.000Z') });
|
|
|
|
expect(html).not.toContain('<script>alert(1)</script>');
|
|
expect(html).not.toContain('<img src=x');
|
|
expect(html).not.toContain('<svg onload');
|
|
expect(html).toContain('<script>alert(1)</script>');
|
|
expect(html).toContain('2026');
|
|
});
|
|
}); |