| 1 | import { readFileSync } from 'node:fs' |
| 2 | import { createRequire } from 'node:module' |
| 3 | import { join } from 'node:path' |
| 4 | import { describe, expect, it } from 'vitest' |
| 5 | |
| 6 | const require = createRequire(import.meta.url) |
| 7 | const ejs = require('ejs') as { |
| 8 | render: (template: string, data: Record<string, unknown>, options: Record<string, unknown>) => string |
| 9 | } |
| 10 | |
| 11 | function renderTemplate(name: string, data: Record<string, unknown>) { |
| 12 | const templatePath = join(process.cwd(), `src/views/channels/auth/${name}.ejs`) |
| 13 | const template = readFileSync(templatePath, 'utf8') |
| 14 | return ejs.render(template, { |
| 15 | locale: 'en-US', |
| 16 | messages: { |
| 17 | title: 'Authorization', |
| 18 | connectedTitle: 'Authorization completed', |
| 19 | redirectingDescription: 'Redirecting you back now.', |
| 20 | closeDescription: 'You can close this page now.', |
| 21 | connectedAccounts: 'Connected accounts', |
| 22 | accountId: 'Account ID', |
| 23 | platformUid: 'Platform ID', |
| 24 | failedTitle: 'Authorization failed', |
| 25 | failedDescription: 'Please close this page and try authorizing again.', |
| 26 | errorCode: 'Error code', |
| 27 | }, |
| 28 | platformDisplayName: 'Facebook', |
| 29 | platformLogoUrl: '', |
| 30 | ...data, |
| 31 | }, { filename: templatePath }) |
| 32 | } |
| 33 | |
| 34 | describe('channel auth callback views', () => { |
| 35 | it('serializes callback redirect values for JavaScript without HTML entities', () => { |
| 36 | const html = renderTemplate('callback', { |
| 37 | callbackUrl: 'https://app.example.test/callback?a=1&b=2', |
| 38 | redirectUri: '/workspace?a=1&b=2', |
| 39 | accounts: [], |
| 40 | }) |
| 41 | |
| 42 | expect(html).toContain('const callbackUrl = "https://app.example.test/callback?a=1\\u0026b=2";') |
| 43 | expect(html).toContain('const redirectUri = "/workspace?a=1\\u0026b=2";') |
| 44 | expect(html).not.toContain('const redirectUri = \'/workspace?a=1&b=2\';') |
| 45 | }) |
| 46 | |
| 47 | it('renders callback errors without script redirects or callback forms', () => { |
| 48 | const html = renderTemplate('error', { |
| 49 | errorCode: 15039, |
| 50 | errorMessage: '</script><script>alert(1)</script> & failed', |
| 51 | }) |
| 52 | |
| 53 | expect(html).toContain('Authorization failed') |
| 54 | expect(html).toContain('</script><script>alert(1)</script> & failed') |
| 55 | expect(html).toContain('Error code: 15039') |
| 56 | expect(html).not.toContain('</script><script>alert(1)</script>') |
| 57 | expect(html).not.toContain('localStorage') |
| 58 | expect(html).not.toContain('callbackForm') |
| 59 | expect(html).not.toContain('window.location.replace') |
| 60 | }) |
| 61 | }) |
| 62 |