import '../../../dist/zn.min.js'; import { expect, fixture } from '@open-wc/testing'; import type { LitElement } from 'lit'; const textSection = async (body: string) => { const el = await fixture( `
${body}
` ); await el.updateComplete; return el.shadowRoot!.querySelector('.text-content')!; }; describe('', () => { it('should render a component', async () => { const el = await fixture(''); expect(el).to.exist; }); it('should decode escaped source in the html body once', async () => { const el = await fixture( '
<p>Test&nbsp;Format</p>
' ); await el.updateComplete; const iframe = el.shadowRoot!.querySelector('iframe')!; expect(iframe.srcdoc).to.contain('

Test Format

'); }); it('should render plain text in the text body as text', async () => { const content = await textSection('1 < 2 && 3 > 2'); expect(content.textContent).to.contain('1 < 2 && 3 > 2'); }); it('should drop images and handlers from markup in the text body', async () => { const content = await textSection('<img src="x" onerror="window.__xss = true"> hello'); expect(content.querySelector('img')).to.be.null; expect(content.textContent).to.contain('hello'); expect((window as unknown as Record).__xss).to.be.undefined; }); it('should render allowed formatting from markup in the text body', async () => { const content = await textSection( '<p><em><strong>Need help?</strong> Visit our ' + '<a href="http://help.example.com" onclick="x()">Help Center</a></em></p>' ); expect(content.querySelector('p em strong')?.textContent).to.equal('Need help?'); const link = content.querySelector('a')!; expect(link.getAttribute('href')).to.equal('http://help.example.com/'); expect(link.getAttribute('rel')).to.equal('noopener noreferrer'); expect(link.hasAttribute('onclick')).to.be.false; expect(content.textContent).to.not.contain('

'); }); it('should keep editor formatting and only colours from styles in the text body', async () => { const content = await textSection( '<p><s>struck</s> <code>inline</code></p><blockquote>quote</blockquote>' + '<pre>block</pre><hr>' + '<p><span style="color: red; background-image: url(https://x.test/p.gif)">red</span></p>' ); expect(content.querySelector('s')?.textContent).to.equal('struck'); expect(content.querySelector('code')?.textContent).to.equal('inline'); expect(content.querySelector('blockquote')?.textContent).to.equal('quote'); expect(content.querySelector('pre')?.textContent).to.equal('block'); expect(content.querySelector('hr')).to.exist; expect(content.querySelector('span')!.getAttribute('style')).to.equal('color: red;'); }); it('should strip unsafe links and dropped elements from markup in the text body', async () => { const content = await textSection( '<p><a href="JavaScript:alert(1)">click</a></p>' + '<style>p{color:red}</style><script>window.__xss = true</script>' ); expect(content.querySelector('a')!.hasAttribute('href')).to.be.false; expect(content.querySelector('style, script')).to.be.null; expect(content.textContent).to.not.contain('color:red'); expect((window as unknown as Record).__xss).to.be.undefined; }); it('should treat escaped breaks in the text body as line breaks', async () => { const content = await textSection('line1<br />line2'); expect(content.textContent).to.not.contain(' { const preview = async (body: string) => { const el = await fixture( `

${body}
` ); await el.updateComplete; return el.shadowRoot!.querySelector('.content-block-header__description')!.textContent; }; expect(await preview('test&nbsp;send')).to.equal('test send'); expect(await preview('<p>Hello</p><p>there</p>')).to.equal('Hello there'); expect(await preview('From: Bob <bob@example.com>')).to.equal('From: Bob '); }); });