| x |
| x |
h
p
', ON ); expect(parse(out, 'h1')!.style.margin).to.not.equal(''); expect(parse(out, 'p')!.style.margin).to.not.equal(''); }); it('5. keeps table border and background-color', () => { const out = sanitizeHtml( '| x |
kept
', ON ); expect(out).to.not.include('preheader secret'); expect(out).to.include('kept'); }); it('8. drops mso-hide:all elements with their content', () => { const out = sanitizeHtml( 'hidden msg
kept
', ON ); expect(out).to.not.include('hidden msg'); expect(out).to.include('kept'); }); }); describe('email-fidelity: fixture round-trip (flag on)', () => { it('9. layout styles survive sanitize', () => { const out = sanitizeHtml(EMAIL_FIXTURE, ON); // 600px container width + max-width. const container = parseAll(out, 'table').find(t => t.style.maxWidth === '600px'); expect(container, '600px container').to.exist; // Callout left border. const callout = parseAll(out, 'td').find(t => t.style.borderLeftStyle === 'solid'); expect(callout, 'callout border-left').to.exist; // Footer top border. const footer = parseAll(out, 'td').find(t => t.style.borderTopStyle === 'solid'); expect(footer, 'footer border-top').to.exist; // Some cell keeps padding. expect(parseAll(out, 'td').some(t => t.style.padding !== '' || t.style.paddingTop !== '')).to.equal( true ); }); it('10. layout styles survive a full htmlToDoc→docToHtml round-trip', () => { const doc = htmlToDoc(defaultSchema, EMAIL_FIXTURE, true, ON); const out = docToHtml(doc); expect(parseAll(out, 'table').some(t => t.style.maxWidth === '600px'), '600px width').to.equal( true ); expect(parseAll(out, 'td').some(t => t.style.borderLeftStyle === 'solid'), 'callout').to.equal( true ); expect(parseAll(out, 'td').some(t => t.style.borderTopStyle === 'solid'), 'footer').to.equal( true ); expect(parseAll(out, 'td').some(t => t.style.paddingTop !== '' || t.style.padding !== ''), 'padding') .to.equal(true); // Paragraph margins preserved. expect(parseAll(out, 'p').some(p => p.style.marginBottom !== '' || p.style.margin !== ''), 'p margin') .to.equal(true); }); it('11. no text-run span inherits a table/cell background-color or font-family', () => { const doc = htmlToDoc(defaultSchema, EMAIL_FIXTURE, true, ON); const out = docToHtml(doc); for (const span of parseAll(out, 'span')) { expect(span.style.backgroundColor, `span bg: ${span.outerHTML}`).to.equal(''); // Arial is only ever set on cells in the fixture; Georgia is set on the // header/
themselves and is allowed to mark their own text. expect(span.style.fontFamily, `span font: ${span.outerHTML}`).to.not.include('Arial'); } }); it('11b. a paragraph/heading keeps its own colour and font', () => { const out = docToHtml(htmlToDoc(defaultSchema, EMAIL_FIXTURE, true, ON)); const header = parseAll(out, 'p').find(p => p.textContent === 'Company Name'); expect(header?.innerHTML).to.include('Georgia'); expect(header?.innerHTML).to.include('24px'); expect(header?.innerHTML).to.match(/color: (?:rgb\(255, 255, 255\)|#ffffff)/); expect(parseAll(out, 'h1')[0].innerHTML).to.include('Georgia'); }); it('11c. a container table centred by its holding cell keeps auto side margins', () => { const out = docToHtml( htmlToDoc( defaultSchema, '
|
x
` : `| x |
x
` : `| x |
x
', ' x', '| x |
nested block
a paragraph
', 'heading
', '- item
quote', '
x
after comment
',
];
for (const text of truthy) {
it(`19. true for: ${text.slice(0, 32)}`, () => {
expect(looksLikeHtml(text)).to.equal(true);
});
}
const falsy = [
'Just some plain prose with no markup at all.',
'A markdown line with a stray in it', 'inline **markdown** with a bold word only', 'a < b > c is a math comparison, not html', '', ' ', ]; for (const text of falsy) { it(`20. false for: ${text.slice(0, 32)}`, () => { expect(looksLikeHtml(text)).to.equal(false); }); } }); // --------------------------------------------------------------------------- // allowedStyles — custom allowlist extension // (spec: "Custom allowlist extension"; plan nile-qa sections A–E, G) // --------------------------------------------------------------------------- import { normalizeEmailAllowedStyles, parseAllowedStylesAttr, isExtensionPropValid, isExtensionValueValid, sanitizeExtraStyleForWrite, } from './email-css'; import { jsonToDoc } from './serializer'; /** email-fidelity-on options carrying a normalized app allowlist. */ const WITH = (styles: Record
| x |
', () => { const out = sanitizeHtml( '
x
', WITH({ p: ['letter-spacing'] }) ); expect(extra(out, 'p')).to.include('letter-spacing: 0.5px'); expect(parse(out, 'p')!.style.letterSpacing).to.equal(''); }); it('A3. keeps an extension prop on an', () => {
const out = sanitizeHtml(
'x
',
WITH({ h2: ['letter-spacing'] })
);
expect(extra(out, 'h2')).to.include('letter-spacing: 0.5px');
expect(parse(out, 'h2')!.style.letterSpacing).to.equal('');
});
it('A4. round-trips the prop onto live p/td style via htmlToDoc→docToHtml', () => {
const out = docToHtml(
htmlToDoc(
defaultSchema,
'
x
| y |
x
'; const once = docToHtml(htmlToDoc(defaultSchema, src, true, cfg)); const twice = docToHtml(htmlToDoc(defaultSchema, once, true, cfg)); expect(twice).to.equal(once); }); it('A6. multiple props and tags survive (non-built-in names only)', () => { const out = sanitizeHtml( '| x |
| x |
| x |
| x |
| x |
| x |
| x |
x
',
WITH({ script: ['letter-spacing'], span: ['letter-spacing'], div: ['letter-spacing'] })
);
expect(extra(out, 'div')).to.not.include('letter-spacing');
expect(extra(out, 'span')).to.not.include('letter-spacing');
});
it('C-mso. mso-line-height-rule is kept', () => {
const out = sanitizeHtml(
'| x |
secret
kept
', WITH({ p: ['letter-spacing'] }) ); expect(out).to.not.include('secret'); expect(out).to.include('kept'); }); }); describe('allowedStyles: JSON trust boundary (section D)', () => { it('D1. a paragraph extraStyle keeps a safe decl but strips a denylisted one', () => { const doc = jsonToDoc(defaultSchema, { type: 'doc', content: [ { type: 'paragraph', attrs: { extraStyle: 'letter-spacing: 1px; position: fixed' }, content: [{ type: 'text', text: 'x' }], }, ], }); const out = docToHtml(doc); expect(out).to.include('letter-spacing'); expect(out).to.not.include('position'); }); it('D2. a table cell extraStyle keeps a safe decl but strips a denylisted one', () => { const doc = jsonToDoc(defaultSchema, { type: 'doc', content: [ { type: 'table', content: [ { type: 'table_row', content: [ { type: 'table_cell', attrs: { extraStyle: 'letter-spacing: 1px; position: fixed' }, content: [{ type: 'paragraph', content: [{ type: 'text', text: 'x' }] }], }, ], }, ], }, ], }); const out = docToHtml(doc); expect(parse(out, 'td')!.style.letterSpacing).to.equal('1px'); expect(parse(out, 'td')!.style.position).to.equal(''); }); }); describe('allowedStyles: cell padding per-side fix (section E)', () => { it('E1. a td with only padding-top survives a round-trip', () => { const out = docToHtml( htmlToDoc(defaultSchema, '| x |
| x |
| x |
x |
x |
x |
x |
x |
x |
x |
|
|
x |
' +
'
Powered by Aquera |
' +
'
t |
Powered by Aquera
x |
Powered by Aquera
');
expect(parse(out, 'p')!.style.textAlign).to.equal('center');
});
it('C3.2. CSS text-align on a div does NOT centre a nested table as a block', () => {
const out = roundTripOn(
'x |
Powered by Aquera
');
expect(parse(out, 'p')!.style.textAlign).to.equal('center');
});
it('C4.2. div align="center" centres a nested table as a block', () => {
const out = roundTripOn(
'x |
Powered by Aquera |
x |
Powered by Aquera |
x
x
'), 'p')?.style.textAlign ?? ''
).to.equal('');
expect(
parse(
roundTripOff(
'x |
x
x
',
'x
',
'x |
x |
hello |
x |
a | b | c |
a | b | c |
a | c | |
| b | c |
x |
x |
x |
x |
| |||
The Magic of Green Tea | |||
|
Get 20% off our premium green tea collection! | |||
|
| text |
| Get discount |
| Shop now |
before btn after
' ); expect(parse(out, 'p table'), 'no table; link is not the only content').to.not.exist; expect(parse(out, 'p')!.textContent).to.include('before'); expect(parse(out, 'p')!.textContent).to.include('after'); }); }); describe('button links: block replacement (email-fidelity on)', () => { it('BL18. awhose only content is a button link is replaced by the table', () => { const out = roundTripOn( '
' ); const link = parse(out, 'a')!; const table = link.closest('table'); expect(table, 'link now inside a table').to.exist; // The original is replaced by the table (the cell's own paragraph is just
// ProseMirror's block+ cell content model).
expect(table!.closest('p'), 'table not nested in the old paragraph').to.not.exist;
expect(out.trim().startsWith('
'
);
const link = parse(out, 'a')!;
const inner = link.closest('td')!;
// The link's immediate cell now carries the padding...
const uniform = inner.style.padding === '13px 28px';
const perSide =
inner.style.paddingTop === '13px' &&
inner.style.paddingRight === '28px' &&
inner.style.paddingBottom === '13px' &&
inner.style.paddingLeft === '28px';
expect(uniform || perSide, `inner padding was "${inner.style.cssText}"`).to.equal(true);
// ...and the outer navy cell background survives somewhere above it.
const navy = parseAll(out, 'td').some(
t => t.style.backgroundColor === 'rgb(31, 58, 95)'
);
expect(navy, 'navy background retained').to.equal(true);
});
});
describe('button links: flag off (unchanged 2.0.16 behaviour)', () => {
it('BL20. flag off: the button link is NOT turned into a table', () => {
const out = roundTripOff(BTN_GET_DISCOUNT);
// The only table is the original wrapper; the link is not wrapped in a new one.
const link = parse(out, 'a')!;
const cell = link.closest('td')!;
expect(cell.querySelector('table'), 'no nested button table').to.not.exist;
});
it('BL21. flag off: no cell carries the button background-color', () => {
const out = roundTripOff(BTN_GET_DISCOUNT);
const anyBg = parseAll(out, 'td').some(
t => t.style.backgroundColor === 'rgb(64, 107, 30)'
);
expect(anyBg).to.equal(false);
});
});
describe('button links: security (email-fidelity on)', () => {
it('BL22. a hostile padding:url(x) never reaches the button cell', () => {
const out = roundTripOn(
''
);
expect(out).to.not.include('url(');
const bg = parseAll(out, 'td').some(t => t.style.backgroundColor === 'rgb(64, 107, 30)');
if (bg) {
const td = buttonCell(out);
expect(td.style.padding, 'padding must be empty').to.equal('');
}
});
it('BL23. a background-color:expression(...) is dropped', () => {
const out = roundTripOn(
''
);
expect(out).to.not.include('expression(');
});
it('BL24. a javascript: href on a button link is stripped', () => {
const out = roundTripOn(
''
);
const link = parse(out, 'a');
if (link) {
expect((link.getAttribute('href') ?? '').toLowerCase()).to.not.include('javascript:');
}
expect(out.toLowerCase()).to.not.include('javascript:');
});
});
describe('button links: fixpoint (email-fidelity on)', () => {
it('BL25. "Get discount" is a serialize → parse → serialize fixpoint', () => {
const once = roundTripOn(BTN_GET_DISCOUNT);
expect(roundTripOn(once)).to.equal(once);
});
it('BL26. the reloaded button is not re-detected (link no longer has box styles)', () => {
const once = roundTripOn(BTN_GET_DISCOUNT);
// After one pass the link has no display/padding, so a second pass must not
// add another nested table layer.
const tablesOnce = parseAll(once, 'table').length;
const tablesTwice = parseAll(roundTripOn(once), 'table').length;
expect(tablesTwice).to.equal(tablesOnce);
});
it('BL27. "Shop now" is a serialize → parse → serialize fixpoint', () => {
const once = roundTripOn(BTN_SHOP_NOW);
expect(roundTripOn(once)).to.equal(once);
});
});
Confirm