diff options
Diffstat (limited to 'internal/web/render_test.go')
| -rw-r--r-- | internal/web/render_test.go | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/internal/web/render_test.go b/internal/web/render_test.go index c42e1b1..87ee62d 100644 --- a/internal/web/render_test.go +++ b/internal/web/render_test.go @@ -30,6 +30,30 @@ func TestBuiltinThemes(t *testing.T) { } } +func TestThemeCSSGuardRejectsInvalidNames(t *testing.T) { + t.Setenv("XDG_CONFIG_HOME", t.TempDir()) // no user themes + for _, name := range []string{"../../etc/passwd", "..", "a/b", ""} { + if _, err := themeCSS(name); err == nil { + t.Errorf("themeCSS(%q): expected error, got nil", name) + } + } +} + +func TestRenderReadingsEscapesScriptText(t *testing.T) { + secs := []liturgy.Section{{ + Heading: "Test", + PartID: "pierwsze_czytanie", + Paragraphs: [][]string{{"<script>alert(1)</script>"}}, + }} + html := string(RenderReadings(secs, []string{"pl"}, "new")) + if strings.Contains(html, "<script>alert(1)</script>") { + t.Errorf("raw <script> leaked into rendered output: %q", html) + } + if !strings.Contains(html, "<script>alert(1)</script>") { + t.Errorf("expected escaped script tag in output: %q", html) + } +} + func TestUserTheme(t *testing.T) { dir := t.TempDir() t.Setenv("XDG_CONFIG_HOME", dir) |