diff --git a/src/index.test.ts b/src/index.test.ts index 258dad6..2c338cc 100644 --- a/src/index.test.ts +++ b/src/index.test.ts @@ -1,3 +1,4 @@ +import { getDefaultCSSWhiteList } from "xss"; import { Sanitizer } from "./index"; // This file contains basic tests that validate the utility methods. @@ -38,6 +39,20 @@ describe("Sanitizer", () => { "radarscope" ]; + function getCSSOptions() { + const cssWhiteList = getDefaultCSSWhiteList(); + cssWhiteList["flex"] = true; + cssWhiteList["flex-basis"] = true; + cssWhiteList["flex-direction"] = true; + cssWhiteList["flex-flow"] = true; + cssWhiteList["flex-grow"] = true; + cssWhiteList["flex-shrink"] = true; + cssWhiteList["flex-wrap"] = true; + cssWhiteList["line-height"] = true; + cssWhiteList["overflow"] = true; + return { whiteList: cssWhiteList }; + } + test("creates the Sanitizer object and extends options appropriately", () => { // Test with no arguments const sanitizer1 = new Sanitizer(); @@ -46,6 +61,7 @@ describe("Sanitizer", () => { defaultSanitizer1.arcgisFilterOptions ); defaultOptions1.whiteList = defaultSanitizer1.arcgisWhiteList; + defaultOptions1.css = getCSSOptions(); expect(sanitizer1.xssFilterOptions).toEqual(defaultOptions1); // Extending the defaults @@ -58,6 +74,7 @@ describe("Sanitizer", () => { filterOptions2.whiteList = defaultSanitizer2.arcgisWhiteList; filterOptions2.whiteList.blink = []; filterOptions2.allowCommentTag = false; + filterOptions2.css = getCSSOptions(); expect(sanitizer2.xssFilterOptions).toEqual(filterOptions2); // Passing an empty whitelist @@ -68,11 +85,25 @@ describe("Sanitizer", () => { defaultSanitizer3.arcgisFilterOptions ); defaultOptions3.whiteList = defaultSanitizer3.arcgisWhiteList; + defaultOptions3.css = getCSSOptions(); expect(sanitizer3.xssFilterOptions).toEqual(defaultOptions3); // Test overriding defaults const sanitizer4 = new Sanitizer({ whiteList: { a: [] } }); expect(sanitizer4.xssFilterOptions).toEqual({ whiteList: { a: [] } }); + + // Extending the CSS defaults + const sanitizer5 = new Sanitizer({ css: { whiteList: { "line-height": false, "align-items": true } } }, true); + const defaultSanitizer5 = new Sanitizer(); + const defaultOptions5 = Object.create( + defaultSanitizer5.arcgisFilterOptions + ); + defaultOptions5.css = getCSSOptions(); + defaultOptions5.css.whiteList["line-height"] = false; + defaultOptions5.css.whiteList["align-items"] = true; + expect((sanitizer5.xssFilterOptions.css as any).whiteList["line-height"]).toBeFalsy(); + expect((sanitizer5.xssFilterOptions.css as any).whiteList["align-items"]).toBeTruthy(); + expect(sanitizer5.xssFilterOptions).toEqual(defaultOptions5); }); test("sanitizes a value", () => { @@ -451,6 +482,7 @@ describe("Sanitizer", () => { const strippedVideoSrc = "