node-soc-lite/test/xss_test.js

A security middleware for NodeJs(express) app to Detect OWASP Top Basic and generate report in your ThreatEquation dashboard.

var should = require('chai').should(),
xss = require('../lib/xss'),
escape = xss.escape,
unescape = xss.unescape;

describe('#escape', function() {
  it('converts & into &', function() {
    escape('&').should.equal('&');
  });

  it('converts " into "', function() {
    escape('"').should.equal('"');
  });

  it('converts \' into '', function() {
    escape('\'').should.equal(''');
  });

  it('converts < into &lt;', function() {
    escape('<').should.equal('&lt;');
  });

  it('converts > into &gt;', function() {
    escape('>').should.equal('&gt;');
  });

  it('returns empty string if called with falsey value', function() {
    escape().should.equal('');
    escape('').should.equal('');
    escape(null).should.equal('');
  });
});

describe('#unescape', function() {
  it('converts &amp; into &', function() {
    unescape('&amp;').should.equal('&');
  });

  it('converts &quot; into "', function() {
    unescape('&quot;').should.equal('"');
  });

  it('converts &#39; into \'', function() {
    unescape('&#39;').should.equal('\'');
  });

  it('converts &lt; into <', function() {
    unescape('&lt;').should.equal('<');
  });

  it('converts &gt; into >', function() {
    unescape('&gt;').should.equal('>');
  });

  it('does not double unescape values', function() {
    unescape('&amp;quot;').should.equal('&quot;');
  });

  it('returns empty string if called with falsey value', function() {
    unescape().should.equal('');
    unescape('').should.equal('');
    unescape(null).should.equal('');
  });
});