Marc Mintel
5397309103
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 20s
Build & Deploy / 🧪 QA (push) Failing after 34s
Build & Deploy / 🏗️ Build (push) Has started running
Build & Deploy / 🚀 Deploy (push) Has been cancelled
Build & Deploy / 🧪 Smoke Test (push) Has been cancelled
Build & Deploy / ⚡ Lighthouse (push) Has been cancelled
Build & Deploy / 🔔 Notify (push) Has been cancelled
1 line
8.8 KiB
Plaintext
1 line
8.8 KiB
Plaintext
{"version":3,"sources":["../../src/utilities/sanitizeUserDataForEmail.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { sanitizeUserDataForEmail } from './sanitizeUserDataForEmail'\n\ndescribe('sanitizeUserDataForEmail', () => {\n it('should remove anchor tags', () => {\n const input = '<a href=\"https://example.com\">Click me</a>'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('Click me')\n })\n\n it('should remove script tags', () => {\n const unsanitizedData = '<script>alert</script>'\n const sanitizedData = sanitizeUserDataForEmail(unsanitizedData)\n expect(sanitizedData).toBe('alert')\n })\n\n it('should remove mixed-case script tags', () => {\n const input = '<ScRipT>alert(1)</sCrIpT>'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('alert1')\n })\n\n it('should remove embedded base64-encoded scripts', () => {\n const input = '<img src=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\">'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('')\n })\n\n it('should remove iframe elements', () => {\n const input = '<iframe src=\"malicious.com\"></iframe>Frame'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('Frame')\n })\n\n it('should remove javascript: links in attributes', () => {\n const input = '<a href=\"javascript:alert(1)\">click</a>'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('click')\n })\n\n it('should remove mismatched script input', () => {\n const input = '<script>console.log(\"test\")'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('console.log\\\"test\\\"')\n })\n\n it('should remove encoded scripts via HTML entities', () => {\n const input = '<script>alert(1)</script>'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('alert1')\n })\n\n it('should remove template injection syntax', () => {\n const input = '{{7*7}}'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('77')\n })\n\n it('should remove invisible zero-width characters', () => {\n const input = 'a\\u200Bler\\u200Bt(\"XSS\")'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('alert\\\"XSS\\\"')\n })\n\n it('should remove CSS expressions within style attributes', () => {\n const input = '<div style=\"width: expression(alert(\\'XSS\\'));\">Hello</div>'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('Hello')\n })\n\n it('should not render SVG with onload event', () => {\n const input = '<svg onload=\"alert(\\'XSS\\')\">Graphic</svg>'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('Graphic')\n })\n\n it('should not allow backtick-based patterns', () => {\n const input = '`alert(\"XSS\")`'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('alert\\\"XSS\\\"')\n })\n\n it('should preserve allowed punctuation', () => {\n const input = `Hello \"world\" - it's safe!`\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe(`Hello \"world\" - it's safe!`)\n })\n\n it('should return empty string for non-string input', () => {\n expect(sanitizeUserDataForEmail(null)).toBe('')\n expect(sanitizeUserDataForEmail(undefined)).toBe('')\n expect(sanitizeUserDataForEmail(123)).toBe('')\n expect(sanitizeUserDataForEmail({})).toBe('')\n })\n\n it('should return empty string for an empty string', () => {\n expect(sanitizeUserDataForEmail('')).toBe('')\n })\n\n it('should collapse excessive whitespace', () => {\n const input = 'This is \\n\\n a test'\n expect(sanitizeUserDataForEmail(input)).toBe('This is a test')\n })\n\n it('should truncate to maxLength characters', () => {\n const input = 'a'.repeat(200)\n const result = sanitizeUserDataForEmail(input, 50)\n expect(result.length).toBe(50)\n })\n\n it('should remove characters outside allowed punctuation', () => {\n const input = 'Hello @#$%^*()_+=[]{}|\\\\~`'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('Hello')\n })\n it('should sanitize syntax in regex-like input', () => {\n const input = '(?=XSS)(?:abc)'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('XSSabc')\n })\n\n it('should handle string of only control characters', () => {\n const input = '\\x01\\x02\\x03\\x04'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('')\n })\n\n it('should sanitize complex script attempt with mixed encoding', () => {\n const input = '<script>alert(String.fromCharCode(88,83,83))</script>'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('alertString.fromCharCode88,83,83')\n })\n\n it('should handle deeply nested HTML tags correctly', () => {\n const input = `<div><section><article><p>Hello <strong>world <em>from <span>deep <a href=\"#\">tags</a></span></em></strong></p></article></section></div>`\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('Hello world from deep tags')\n })\n\n it('should preserve accented Spanish characters', () => {\n const input = '¡Hola! ¿Cómo estás? ÁÉÍÓÚ ÜÑ ñáéíóú ü'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('¡Hola! ¿Cómo estás? ÁÉÍÓÚ ÜÑ ñáéíóú ü')\n })\n\n it('should preserve Arabic characters with diacritics', () => {\n const input = 'مَرْحَبًا بِكَ فِي الْمَوْقِعِ'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('مَرْحَبًا بِكَ فِي الْمَوْقِعِ')\n })\n\n it('should preserve Japanese characters', () => {\n const input = 'こんにちゎ、世界！！〆'\n const result = sanitizeUserDataForEmail(input)\n expect(result).toBe('こんにちゎ、世界！！〆')\n })\n})\n"],"names":["describe","it","expect","sanitizeUserDataForEmail","input","result","toBe","unsanitizedData","sanitizedData","undefined","repeat","length"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,wBAAwB,QAAQ,6BAA4B;AAErEH,SAAS,4BAA4B;IACnCC,GAAG,6BAA6B;QAC9B,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,6BAA6B;QAC9B,MAAMM,kBAAkB;QACxB,MAAMC,gBAAgBL,yBAAyBI;QAC/CL,OAAOM,eAAeF,IAAI,CAAC;IAC7B;IAEAL,GAAG,wCAAwC;QACzC,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,iDAAiD;QAClD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,iCAAiC;QAClC,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,iDAAiD;QAClD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,yCAAyC;QAC1C,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,mDAAmD;QACpD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,2CAA2C;QAC5C,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,iDAAiD;QAClD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,yDAAyD;QAC1D,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,2CAA2C;QAC5C,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,4CAA4C;QAC7C,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,uCAAuC;QACxC,MAAMG,QAAQ,CAAC,0BAA0B,CAAC;QAC1C,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC,CAAC,0BAA0B,CAAC;IAClD;IAEAL,GAAG,mDAAmD;QACpDC,OAAOC,yBAAyB,OAAOG,IAAI,CAAC;QAC5CJ,OAAOC,yBAAyBM,YAAYH,IAAI,CAAC;QACjDJ,OAAOC,yBAAyB,MAAMG,IAAI,CAAC;QAC3CJ,OAAOC,yBAAyB,CAAC,IAAIG,IAAI,CAAC;IAC5C;IAEAL,GAAG,kDAAkD;QACnDC,OAAOC,yBAAyB,KAAKG,IAAI,CAAC;IAC5C;IAEAL,GAAG,wCAAwC;QACzC,MAAMG,QAAQ;QACdF,OAAOC,yBAAyBC,QAAQE,IAAI,CAAC;IAC/C;IAEAL,GAAG,2CAA2C;QAC5C,MAAMG,QAAQ,IAAIM,MAAM,CAAC;QACzB,MAAML,SAASF,yBAAyBC,OAAO;QAC/CF,OAAOG,OAAOM,MAAM,EAAEL,IAAI,CAAC;IAC7B;IAEAL,GAAG,wDAAwD;QACzD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IACAL,GAAG,8CAA8C;QAC/C,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,mDAAmD;QACpD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,8DAA8D;QAC/D,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,mDAAmD;QACpD,MAAMG,QAAQ,CAAC,yIAAyI,CAAC;QACzJ,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,+CAA+C;QAChD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,qDAAqD;QACtD,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;IAEAL,GAAG,uCAAuC;QACxC,MAAMG,QAAQ;QACd,MAAMC,SAASF,yBAAyBC;QACxCF,OAAOG,QAAQC,IAAI,CAAC;IACtB;AACF"} |