| 2324 | } |
| 2325 | |
| 2326 | func TestEscapeProps(t *testing.T) { |
| 2327 | is := is.New(t) |
| 2328 | ctx := context.Background() |
| 2329 | dir := t.TempDir() |
| 2330 | td := testdir.New(dir) |
| 2331 | td.NodeModules["svelte"] = versions.Svelte |
| 2332 | td.Files["controller/controller.go"] = ` |
| 2333 | package controller |
| 2334 | type Controller struct {} |
| 2335 | type Post struct { |
| 2336 | HTML string ` + "`json:\"html\"`" + ` |
| 2337 | } |
| 2338 | func (c *Controller) Show(id string) *Post { |
| 2339 | return &Post{HTML: ` + "`" + `<b>hello ` + "`" + ` + id + ` + "`" + `<script type="text/javascript">alert('xss!')</script></b>` + "`" + `} |
| 2340 | } |
| 2341 | ` |
| 2342 | td.Files["view/show.svelte"] = ` |
| 2343 | <script> |
| 2344 | export let post = {} |
| 2345 | </script> |
| 2346 | <h1>{post.html}</h1> |
| 2347 | ` |
| 2348 | is.NoErr(td.Write(ctx)) |
| 2349 | cli := testcli.New(dir) |
| 2350 | app, err := cli.Start(ctx, "run") |
| 2351 | is.NoErr(err) |
| 2352 | defer app.Close() |
| 2353 | // Post request |
| 2354 | res, err := app.Get("/alice") |
| 2355 | is.NoErr(err) |
| 2356 | props, err := res.Query("#bud_props") |
| 2357 | is.NoErr(err) |
| 2358 | is.Equal(props.Text(), `{"post":{"html":"<b>hello alice<script type=\"text/javascript\">alert('xss!')<\/script></b>"}}`) |
| 2359 | target, err := res.Query("#bud_target") |
| 2360 | is.NoErr(err) |
| 2361 | is.Equal(target.Text(), `<b>hello alice<script type="text/javascript">alert('xss!')</script></b>`) |
| 2362 | } |
| 2363 | |
| 2364 | func TestProtocol(t *testing.T) { |
| 2365 | is := is.New(t) |