package calfeed import ( "strings" "testing" "time" "github.com/lukaszkasprzak/lectio/internal/config" ) func TestICalEscapeInjection(t *testing.T) { // A malicious custom-calendar name must not be able to inject lines/props. got := icalEscape("Evil\r\nBEGIN:VEVENT\nSUMMARY:hijack; a,b\\c") if strings.ContainsAny(got, "\r\n") { t.Fatalf("unescaped newline survived: %q", got) } for _, sub := range []string{`\n`, `\;`, `\,`, `\\`} { if !strings.Contains(got, sub) { t.Fatalf("missing escape %q in %q", sub, got) } } } // TestICalCarriesSourceOffer pins the AGPL-3.0 ยง13 offer into the VCALENDAR // header. Someone who subscribes to /calendar.ics in their calendar app sees // no lectio page at all; the feed is their entire view of the program, so it // carries the offer. X- properties are inert to clients that ignore them. func TestICalCarriesSourceOffer(t *testing.T) { out := string(ICal("new", nil, time.Date(2026, 7, 27, 12, 0, 0, 0, time.UTC))) for _, want := range []string{ "X-LECTIO-SOURCE:" + icalEscape(config.SourceURL), "X-LECTIO-LICENSE:" + icalEscape(config.License), } { if !strings.Contains(out, want) { t.Errorf("missing %q in:\n%s", want, out) } } } func TestICalStructure(t *testing.T) { days := []DayView{{ Date: "2026-01-06", Season: "time-after-epiphany", Week: 1, Colour: "white", Observed: CelView{Name: "The Epiphany of the Lord", Rank: "class-1"}, Readings: []ReadingView{{Part: "gospel", Citation: "Matt 2:1-12"}}, }} out := string(ICal("old", days, time.Date(2026, 7, 27, 12, 0, 0, 0, time.UTC))) for _, want := range []string{ "BEGIN:VCALENDAR", "VERSION:2.0", "PRODID:-//lectio//calendar//EN", "BEGIN:VEVENT", "UID:2026-01-06-old@lectio", "DTSTART;VALUE=DATE:20260106", "DTEND;VALUE=DATE:20260107", "SUMMARY:The Epiphany of the Lord", "CATEGORIES:WHITE", "DTSTAMP:20260727T120000Z", "END:VEVENT", "END:VCALENDAR", } { if !strings.Contains(out, want) { t.Fatalf("missing %q in:\n%s", want, out) } } // injection attempt via day count: exactly one VEVENT if strings.Count(out, "BEGIN:VEVENT") != 1 { t.Fatalf("expected 1 VEVENT") } } func TestFoldLine(t *testing.T) { long := "SUMMARY:" + strings.Repeat("x", 200) for _, line := range strings.Split(foldLine(long), "\r\n") { if len(line) > 75 { t.Fatalf("line exceeds 75 octets: %d", len(line)) } } }