Something went wrong. Try again.
Monorepo for the nibling.run platform
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869import assert from 'node:assert/strict';import { test } from 'node:test';import { escapeHtml, renderEmbedPage, renderOEmbedJson, renderProjectPage, type ProjectCardData } from '../src/cards.ts';
const malicious: ProjectCardData = { actor: 'alice.bsky.social', did: 'did:plc:alice', rkey: '3la1', name: '<script>alert(1)</script>', description: 'a "quoted" & <b>tagged</b> description',};
test('escapeHtml escapes every special character', () => { assert.equal(escapeHtml(`<script>& "'`), '<script>& "'');});
test('renderProjectPage HTML-escapes the project name and carries the exact og:title', () => { const html = renderProjectPage(malicious, 'https://nibling.run'); assert.equal(html.includes('<script>alert(1)</script>'), false); assert.equal( html.includes('<meta property="og:title" content="<script>alert(1)</script>">'), true, ); assert.equal( html.includes('<meta property="og:description" content="a "quoted" & <b>tagged</b> description">'), true, );});
test('renderProjectPage redirects humans via meta refresh to the app URL', () => { const html = renderProjectPage(malicious, 'https://nibling.run'); assert.equal( html.includes('<meta http-equiv="refresh" content="0; url=https://nibling.run/alice.bsky.social/3la1">'), true, );});
test('renderEmbedPage HTML-escapes the name and embeds the app in an iframe', () => { const html = renderEmbedPage(malicious, 'https://nibling.run'); assert.equal(html.includes('<script>alert(1)</script>'), false); assert.equal( html.includes('src="https://nibling.run/alice.bsky.social/3la1/embed"'), true, );});
test('renderOEmbedJson escapes the embed src and keeps the exact title', () => { const oembed = renderOEmbedJson(malicious, 'https://nibling.run'); assert.equal(oembed.type, 'rich'); assert.equal(oembed.title, '<script>alert(1)</script>'); // JSON, not HTML: not escaped assert.equal(oembed.html.includes('<script>alert(1)</script>'), false); assert.equal(oembed.html.includes('src="https://nibling.run/alice.bsky.social/3la1/embed"'), true);});
test('renderProjectPage uses the slug for the app URL when the card has one', () => { const withSlug: ProjectCardData = { ...malicious, slug: 'bouncing-ball' }; const html = renderProjectPage(withSlug, 'https://nibling.run'); assert.equal( html.includes('<meta property="og:url" content="https://nibling.run/alice.bsky.social/bouncing-ball">'), true, );});
test('renderEmbedPage uses the slug for the iframe src when the card has one', () => { const withSlug: ProjectCardData = { ...malicious, slug: 'bouncing-ball' }; const html = renderEmbedPage(withSlug, 'https://nibling.run'); assert.equal(html.includes('src="https://nibling.run/alice.bsky.social/bouncing-ball/embed"'), true);});