Blame · Line-by-line history

`sse-client.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

sse-client.test.tsBlame39 lines · 1 contributor

Normal view Raw

febd4f0Claude	1	import { describe, it, expect } from "bun:test";
	2	import { liveSubscribeScript } from "../lib/sse-client";
	3
	4	describe("liveSubscribeScript", () => {
	5	it("returns a string containing EventSource and the topic path", () => {
	6	const js = liveSubscribeScript({
	7	topic: "repo:abc",
	8	targetElementId: "live-feed",
	9	});
	10
	11	expect(typeof js).toBe("string");
	12	expect(js).toContain("EventSource");
	13	// topic is JSON-encoded then concatenated with the /live-events/ prefix
	14	// at runtime, so both must appear in the emitted script.
	15	expect(js).toContain("/live-events/");
	16	expect(js).toContain('"repo:abc"');
	17	// targetElementId must also be JSON-escaped into the snippet.
	18	expect(js).toContain('"live-feed"');
	19	});
	20
	21	it("JSON-escapes bad topic strings to prevent </script> injection", () => {
	22	const malicious = '</script><script>alert(1)</script>';
	23	const js = liveSubscribeScript({
	24	topic: malicious,
	25	targetElementId: "feed",
	26	});
	27
	28	// Raw closing-tag sequence MUST NOT appear anywhere in the output —
	29	// JSON.stringify escapes `<` when emitted for HTML, but we additionally
	30	// verify the literal bad sequence is absent.
	31	expect(js).not.toContain("</script>");
	32	// Unescaped alert call (in the exact bad form) must not appear.
	33	expect(js).not.toContain("<script>alert(1)");
	34	// The topic should still be represented (escaped) so the subscription
	35	// remains functional — at minimum the inner `alert(1)` literal is there
	36	// as an escaped JSON string, but the HTML-breakout is gone.
	37	expect(js).toContain("EventSource");
	38	});
	39	});