obsidian-plugin/murashit_codex-panel
1
0
Fork 0
mirror of https://github.com/murashit/codex-panel.git synced 2026-07-22 06:57:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add streaming markdown renderer safety tests

Browse source
This commit is contained in:
murashit 2026-06-20 09:17:44 +09:00
parent 1914e986ed
commit d9f65c3b6c
1 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
tests/features/chat/ui/message-stream/stream-markdown-renderer.test.ts
View file

@ -25,6 +25,33 @@ describe("renderStreamMarkdown", () => {
expect(parent.textContent).toBe("Title\nbold text");
});
it("escapes raw HTML while streaming", () => {
const context = streamMarkdownContext();
const parent = document.createElement("div");
renderStreamMarkdown(parent, '<img src=x onerror="alert(1)">\n\n<script>alert(1)</script>', context);
expect(parent.querySelector("img")).toBeNull();
expect(parent.querySelector("script")).toBeNull();
expect(parent.textContent).toContain('<img src=x onerror="alert(1)">');
expect(parent.textContent).toContain("<script>alert(1)</script>");
});
it("neutralizes unsafe link protocols while streaming", () => {
const openLinkText = vi.fn();
const context = streamMarkdownContext({ openLinkText });
const parent = document.createElement("div");
renderStreamMarkdown(parent, "[Run](javascript:alert(1))", context);
const link = parent.querySelector<HTMLAnchorElement>("a");
link?.click();
expect(link?.textContent).toBe("Run");
expect(link?.getAttribute("href")).toBe("");
expect(openLinkText).not.toHaveBeenCalled();
expect(notices).toEqual([]);
});
it("leaves wikilinks as plain text while streaming", () => {
const context = streamMarkdownContext();
const parent = document.createElement("div");