pleno-vue/tests/unit/objects-global-select-xss.spec.js

import { describe, expect, it, vi } from "vitest";

vi.mock("sweetalert2", () => ({
  default: {
    fire: vi.fn(),
  },
}));

vi.mock("@/i18n", () => ({
  default: {
    global: {
      t: (key) => key,
    },
  },
}));

vi.mock("@/components/session/authenticatedRequest.vue", () => ({
  authenticatedRequest: vi.fn(),
  unauthenticatedRequest: vi.fn(),
}));

vi.mock("@/components/session/token/SessionUser/Objects/systemUserIds.js", () => ({
  getSystemUserIds: () => [],
}));

import { ObjectsGlobal } from "@/components/session/token/SessionUser/Objects/ObjectsGlobal.vue";

describe("ObjectsGlobal select editor escaping", () => {
  it("escapes option ids and names before rendering SweetAlert HTML", async () => {
    const object = {
      columns: {
        relay_in_id: {
          label: "Relay",
          type: "select",
          options: vi.fn().mockResolvedValue([
            {
              id: 'relay-1" autofocus onfocus="alert(1)',
              name: '</option></select><iframe src="javascript:parent.localStorage.token"></iframe>',
            },
          ]),
        },
      },
    };

    const html = await ObjectsGlobal.generateEditObjectFieldForm(object, "relay_in_id", null);

    expect(html).not.toContain("</option></select><iframe");
    expect(html).not.toContain("<iframe");
    expect(html).not.toContain('value="relay-1" autofocus');
    expect(html).toContain("relay-1&quot; autofocus onfocus=&quot;alert(1)");
    expect(html).toContain(
      "&lt;/option&gt;&lt;/select&gt;&lt;iframe src=&quot;javascript:parent.localStorage.token&quot;&gt;&lt;/iframe&gt;"
    );
  });
});