boos
e0a5f57793
Vendor the rebranded BoosAPI Desktop client (Tauri + Vue) into metapi as a monorepo subdirectory under desktop/. Source only — node_modules, dist, Cargo target and the upstream .git history are excluded. desktop/ keeps its own independent Cargo workspace (desktop/src-tauri with crates/*); it is not part of the backend boosapi crate, so a `cargo check` at the metapi root still compiles only the backend. Build the desktop app from desktop/src-tauri per desktop/README.md. Note: app icons are still placeholder assets pending the final BoosAPI logo. The updater signing keys live outside the repo and are not included.
22 lines
920 B
TypeScript
22 lines
920 B
TypeScript
import { sanitizeHtmlContent } from 'stream-markdown-parser'
|
|
import { describe, expect, it } from 'vitest'
|
|
|
|
describe('sanitizeHtmlContent', () => {
|
|
it('removes dangerous attrs, unsafe urls, and blocked tags', () => {
|
|
const html = sanitizeHtmlContent('<div onclick="evil()">Hello <img src="x" onerror="evil()"><a href="javascript:alert(1)" title="ok">Link</a><script>alert(1)</script></div>')
|
|
|
|
expect(html).toContain('<div>Hello <img src="x"><a title="ok">Link</a></div>')
|
|
expect(html).not.toContain('onclick')
|
|
expect(html).not.toContain('onerror')
|
|
expect(html).not.toContain('javascript:')
|
|
expect(html).not.toContain('<script')
|
|
expect(html).not.toContain('alert(1)')
|
|
})
|
|
|
|
it('preserves whitespace around safe inline html', () => {
|
|
const html = sanitizeHtmlContent('Hello <span data-safe="1">world</span> !')
|
|
|
|
expect(html).toBe('Hello <span data-safe="1">world</span> !')
|
|
})
|
|
})
|