package webapp
import (
"strings"
"testing"
"testing/fstest"
)
func TestRenderShellInjectsBootPayloadBeforeHeadClose(t *testing.T) {
t.Parallel()
assets := fstest.MapFS{
"index.html": {
Data: []byte("Kandev"),
},
}
payload := NewBootPayload(
ClassifyRoute("/t/task-1"),
RuntimeConfig{APIPrefix: "/api/v1", WebSocketPath: "/ws"},
map[string]any{"title": "Task"},
)
html, err := RenderShell(assets, "index.html", payload)
if err != nil {
t.Fatalf("RenderShell: %v", err)
}
got := string(html)
scriptIdx := strings.Index(got, bootPayloadGlobal)
headCloseIdx := strings.Index(got, "")
if scriptIdx < 0 {
t.Fatalf("rendered shell missing boot payload script: %s", got)
}
if headCloseIdx < 0 || scriptIdx > headCloseIdx {
t.Fatalf("boot payload script should be injected before : %s", got)
}
if !strings.Contains(got, `"taskId":"task-1"`) {
t.Fatalf("rendered shell missing route params: %s", got)
}
}
func TestBootPayloadScriptEscapesScriptTerminators(t *testing.T) {
t.Parallel()
payload := NewBootPayload(
ClassifyRoute("/"),
RuntimeConfig{},
map[string]any{"title": ""},
)
script, err := BootPayloadScript(payload)
if err != nil {
t.Fatalf("BootPayloadScript: %v", err)
}
if strings.Contains(string(script), "`,
wantTitle: "</title><script>alert(1)</script> Kandev",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
assets := fstest.MapFS{
"index.html": {
Data: []byte(`Kandev`),
},
}
payload := NewBootPayload(ClassifyRoute("/"), RuntimeConfig{TitlePrefix: tc.prefix}, nil)
html, err := RenderShell(assets, "index.html", payload)
if err != nil {
t.Fatalf("RenderShell: %v", err)
}
if got := string(html); !strings.Contains(got, tc.wantTitle) {
t.Fatalf("expected %q in shell, got: %s", tc.wantTitle, got)
}
})
}
}
func TestRenderShellLeavesShellWithoutTitleUntouched(t *testing.T) {
t.Parallel()
assets := fstest.MapFS{
"index.html": {Data: []byte(``)},
}
payload := NewBootPayload(ClassifyRoute("/"), RuntimeConfig{TitlePrefix: "TEST"}, nil)
html, err := RenderShell(assets, "index.html", payload)
if err != nil {
t.Fatalf("RenderShell: %v", err)
}
if strings.Contains(string(html), "