page_tests.c (2046B)
1 #include "writer/html/page.h" 2 3 #include <stdio.h> 4 #include <stdlib.h> 5 #include <string.h> 6 7 #include "fs_inmemory.h" 8 #include "git/repo.h" 9 #include "test_utils.h" 10 #include "utest.h" 11 12 struct html_page { 13 int dummy; 14 }; 15 16 UTEST_F_SETUP(html_page) { 17 inmemory_fs_clear(); 18 } 19 20 UTEST_F_TEARDOWN(html_page) {} 21 22 UTEST_F(html_page, basic) { 23 RepoSpecialFile sf = {.label = "LICENSE", .path = "LICENSE"}; 24 GitRepo repo = { 25 .short_name = "test-repo", 26 .description = "Repo description", 27 .clone_url = "git://example.com/repo.git", 28 .special_files = &sf, 29 .special_files_len = 1, 30 }; 31 32 FILE* out = g_fs_inmemory->fopen("test.html", "w"); 33 HtmlPage* page = 34 html_page_create(out, &repo, g_fs_inmemory, "Page Title", "../"); 35 ASSERT_NE(NULL, page); 36 37 html_page_begin(page); 38 html_page_end(page); 39 g_fs_inmemory->fclose(out); 40 html_page_free(page); 41 42 const char* buf = inmemory_fs_get_buffer("test.html"); 43 ASSERT_NE(NULL, buf); 44 45 /* Verify Header/Title */ 46 EXPECT_STR_SEQUENCE(buf, "<title>", "Page Title", "test-repo", 47 "Repo description", "</title>"); 48 49 /* Verify Navigation */ 50 EXPECT_STR_SEQUENCE(buf, "href=\"../log.html\">Log</a>", 51 "href=\"../files.html\">Files</a>", 52 "href=\"../refs.html\">Refs</a>"); 53 54 /* Verify Metadata */ 55 EXPECT_STR_SEQUENCE(buf, "git clone", "git://example.com/repo.git", 56 "LICENSE"); 57 } 58 59 UTEST_F(html_page, unsafe_url) { 60 GitRepo repo = { 61 .clone_url = "javascript:alert(1)", 62 }; 63 64 FILE* out = g_fs_inmemory->fopen("unsafe.html", "w"); 65 HtmlPage* page = html_page_create(out, &repo, g_fs_inmemory, "Title", ""); 66 ASSERT_NE(NULL, page); 67 html_page_begin(page); 68 g_fs_inmemory->fclose(out); 69 html_page_free(page); 70 71 const char* buf = inmemory_fs_get_buffer("unsafe.html"); 72 ASSERT_NE(NULL, buf); 73 /* Verify that the unsafe URL is NOT turned into an <a> tag. */ 74 EXPECT_NE(NULL, strstr(buf, "javascript:alert(1)")); 75 EXPECT_EQ(NULL, strstr(buf, "href=\"javascript:alert(1)\"")); 76 }