Files
govoplan-core/webui/tests/dependency-security.test.mjs
T

28 lines
1.3 KiB
JavaScript

import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import test from "node:test";
import { mergeAttributes } from "@tiptap/core";
test("development and release manifests retain the patched rich-text dependency floor", () => {
for (const filename of ["package.json", "package.release.json"]) {
const manifest = JSON.parse(readFileSync(new URL(`../${filename}`, import.meta.url), "utf8"));
for (const name of ["core", "extension-image", "pm", "react", "starter-kit"]) {
assert.equal(manifest.dependencies[`@tiptap/${name}`], "^3.30.4", `${filename}: @tiptap/${name}`);
}
}
});
test("rich-text attribute merging cannot inherit executable attributes from a JSON prototype key", () => {
const untrusted = JSON.parse('{"__proto__":{"onerror":"fixture-canary","src":"fixture-invalid"},"title":"Safe title"}');
const attributes = mergeAttributes({ class: "preview" }, untrusted);
assert.equal(Object.getPrototypeOf(attributes), Object.prototype);
assert.equal(attributes.onerror, undefined);
assert.equal(attributes.src, undefined);
assert.equal(attributes.title, "Safe title");
const enumerable = [];
for (const key in attributes) enumerable.push(key);
assert.ok(!enumerable.includes("onerror"));
assert.ok(!enumerable.includes("src"));
assert.equal(Object.prototype.onerror, undefined);
});