tl-shared-security
Version:
Enterprise-grade security module for frontend and backend applications with comprehensive protection against XSS, CSRF, SQL injection, and other security vulnerabilities
74 lines • 4 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const xssSanitizer_1 = require("./xssSanitizer");
describe('XssSanitizer', () => {
describe('sanitize', () => {
it('should sanitize XSS attacks in HTML', () => {
const sanitizer = new xssSanitizer_1.XssSanitizer();
const malicious = '<script>alert("XSS")</script><b>Hello</b>';
const sanitized = sanitizer.sanitize(malicious);
expect(sanitized).not.toContain('<script>');
expect(sanitized).toContain('<b>Hello</b>');
});
it('should handle null and undefined inputs', () => {
const sanitizer = new xssSanitizer_1.XssSanitizer();
expect(sanitizer.sanitize(null)).toBe('');
expect(sanitizer.sanitize(undefined)).toBe('');
});
it('should sanitize complex HTML according to whitelist', () => {
const sanitizer = new xssSanitizer_1.XssSanitizer();
const html = '<div class="container"><h1>Title</h1><p>Text with <b>bold</b> and <i>italic</i></p><script>alert("XSS")</script></div>';
const sanitized = sanitizer.sanitize(html);
expect(sanitized).toContain('<div class="container">');
expect(sanitized).toContain('<h1>Title</h1>');
expect(sanitized).toContain('<p>Text with <b>bold</b> and <i>italic</i></p>');
expect(sanitized).not.toContain('<script>');
});
});
describe('sanitizeRecursive', () => {
it('should sanitize strings in objects and arrays', () => {
const sanitizer = new xssSanitizer_1.XssSanitizer();
const data = {
name: '<script>alert("XSS")</script>John',
details: {
bio: '<img src="x" onerror="alert(\'XSS\')">Bio',
},
tags: ['<script>alert("XSS")</script>Tag1', 'Tag2'],
};
const sanitized = sanitizer.sanitizeRecursive(data);
expect(sanitized.name).not.toContain('<script>');
expect(sanitized.details.bio).not.toContain('onerror');
expect(sanitized.tags[0]).not.toContain('<script>');
expect(sanitized.tags[1]).toBe('Tag2');
});
it('should handle null and undefined values', () => {
const sanitizer = new xssSanitizer_1.XssSanitizer();
expect(sanitizer.sanitizeRecursive(null)).toBeNull();
expect(sanitizer.sanitizeRecursive(undefined)).toBeUndefined();
});
});
describe('sanitizeUrl', () => {
it('should sanitize malicious URLs', () => {
const sanitizer = new xssSanitizer_1.XssSanitizer();
expect(sanitizer.sanitizeUrl('javascript:alert("XSS")')).toBe('');
expect(sanitizer.sanitizeUrl('https://example.com')).toBe('https://example.com');
expect(sanitizer.sanitizeUrl('data:text/html,<script>alert("XSS")</script>')).toBe('data:text/html,<script>alert("XSS")</script>');
});
it('should handle null and undefined URLs', () => {
const sanitizer = new xssSanitizer_1.XssSanitizer();
expect(sanitizer.sanitizeUrl(null)).toBe('');
expect(sanitizer.sanitizeUrl(undefined)).toBe('');
});
});
describe('exported functions', () => {
it('should export convenience functions that use the default sanitizer', () => {
const malicious = '<script>alert("XSS")</script><b>Hello</b>';
expect((0, xssSanitizer_1.sanitizeInput)(malicious)).not.toContain('<script>');
expect((0, xssSanitizer_1.sanitizeInput)(malicious)).toContain('<b>Hello</b>');
expect((0, xssSanitizer_1.sanitizeUrl)('javascript:alert("XSS")')).toBe('');
const data = { text: '<script>alert("XSS")</script>' };
expect((0, xssSanitizer_1.sanitizeRecursive)(data).text).not.toContain('<script>');
});
});
});
//# sourceMappingURL=xssSanitizer.spec.js.map