21 lines
1.2 KiB
TypeScript
21 lines
1.2 KiB
TypeScript
import { createElement, type ComponentType, type ReactNode } from "react";
|
|
import { renderToStaticMarkup } from "react-dom/server";
|
|
import { expect, it } from "vitest";
|
|
import { artifactLinkComponents, artifactLinksPlugin } from "./artifact-markdown";
|
|
|
|
it("keeps external link safety and rejects forged custom export links", () => {
|
|
const Renderer = artifactLinkComponents["agent-export-link"] as ComponentType<{ href: string; children: ReactNode }>;
|
|
const path = "/api/v1/session/s/files/mcp-11111111-1111-1111-1111-111111111111.zip";
|
|
const render = (href: string) => renderToStaticMarkup(createElement(Renderer, { href, children: "下载" }));
|
|
expect(render(path)).toContain(`<a href="${path}"`);
|
|
for (const href of ["https://foreign.test/x", "javascript:alert(1)", "/api/v1/admin/secrets"]) {
|
|
expect(render(href)).toBe("<span>下载</span>");
|
|
}
|
|
const root = { type: "root", children: [
|
|
{ type: "element", tagName: "a", properties: { href: path } },
|
|
{ type: "element", tagName: "a", properties: { href: "https://example.com" } },
|
|
] };
|
|
artifactLinksPlugin()(root);
|
|
expect(root.children.map((child) => child.tagName)).toEqual(["agent-export-link", "a"]);
|
|
});
|