Skip to content

Commit

Permalink
update test
Browse files Browse the repository at this point in the history
  • Loading branch information
Conduitry committed Aug 29, 2022
1 parent ae09a98 commit 652f526
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions packages/kit/src/utils/escape.spec.js
Original file line number Diff line number Diff line change
Expand Up @@ -5,22 +5,24 @@ import { render_json_payload_script, escape_html_attr } from './escape.js';
const json = suite('render_json_payload_script');

json('escapes slashes', () => {
// The type here doesn't really matter for the purposes of escaping,
// but want to avoid upsetting TypeScript.
assert.equal(
render_json_payload_script({ type: 'server_data' }, [
render_json_payload_script({ type: 'validation_errors' }, [
{ unsafe: '</script><script>alert("xss")' }
]),
'<script type="application/json" sveltekit:data-type="server_data">' +
'<script type="application/json" sveltekit:data-type="validation_errors">' +
'[{"unsafe":"\\u003C/script>\\u003Cscript>alert(\\"xss\\")"}]' +
'</script>'
);
});

json('escapes exclamation marks', () => {
assert.equal(
render_json_payload_script({ type: 'server_data' }, [
render_json_payload_script({ type: 'validation_errors' }, [
{ '<!--</script>...-->alert("xss")': 'unsafe' }
]),
'<script type="application/json" sveltekit:data-type="server_data">' +
'<script type="application/json" sveltekit:data-type="validation_errors">' +
'[{"\\u003C!--\\u003C/script>...-->alert(\\"xss\\")":"unsafe"}]' +
'</script>'
);
Expand Down

0 comments on commit 652f526

Please sign in to comment.