mirror of https://github.com/langgenius/dify.git
60 lines
1.7 KiB
TypeScript
60 lines
1.7 KiB
TypeScript
import { cleanUpSvgCode, prepareMermaidCode, sanitizeMermaidCode } from './utils'
|
|
|
|
describe('cleanUpSvgCode', () => {
|
|
it('replaces old-style <br> tags with the new style', () => {
|
|
const result = cleanUpSvgCode('<br>test<br>')
|
|
expect(result).toEqual('<br/>test<br/>')
|
|
})
|
|
})
|
|
|
|
describe('sanitizeMermaidCode', () => {
|
|
it('removes click directives to prevent link/callback injection', () => {
|
|
const unsafeProtocol = ['java', 'script:'].join('')
|
|
const input = [
|
|
'gantt',
|
|
'title Demo',
|
|
'section S1',
|
|
'Task 1 :a1, 2020-01-01, 1d',
|
|
`click A href "${unsafeProtocol}alert(location.href)"`,
|
|
'click B call callback()',
|
|
].join('\n')
|
|
|
|
const result = sanitizeMermaidCode(input)
|
|
|
|
expect(result).toContain('gantt')
|
|
expect(result).toContain('Task 1')
|
|
expect(result).not.toContain('click A')
|
|
expect(result).not.toContain('click B')
|
|
expect(result).not.toContain(unsafeProtocol)
|
|
})
|
|
|
|
it('removes Mermaid init directives to prevent config overrides', () => {
|
|
const input = [
|
|
'%%{init: {"securityLevel":"loose"}}%%',
|
|
'graph TD',
|
|
'A-->B',
|
|
].join('\n')
|
|
|
|
const result = sanitizeMermaidCode(input)
|
|
|
|
expect(result).toEqual(['graph TD', 'A-->B'].join('\n'))
|
|
})
|
|
})
|
|
|
|
describe('prepareMermaidCode', () => {
|
|
it('sanitizes click directives in flowcharts', () => {
|
|
const unsafeProtocol = ['java', 'script:'].join('')
|
|
const input = [
|
|
'graph TD',
|
|
'A[Click]-->B',
|
|
`click A href "${unsafeProtocol}alert(1)"`,
|
|
].join('\n')
|
|
|
|
const result = prepareMermaidCode(input, 'classic')
|
|
|
|
expect(result).toContain('graph TD')
|
|
expect(result).not.toContain('click ')
|
|
expect(result).not.toContain(unsafeProtocol)
|
|
})
|
|
})
|