[quality] add 33 unit tests for src/lib/sanitizeHtml.ts (XSS defense module) - #6822
Conversation
Adds src/__tests__/sanitizeHtml.test.ts covering the primary XSS-defense module used to sanitize user-supplied MDX before rendering. The module previously had no direct unit tests, despite carrying the security-critical duty of stripping script/style/iframe tags, inline event handlers, comments, CDATA/DOCTYPE/PI, and normalizing img/br/hr/class attributes. Tests cover: - stripUntilStable: no-op, direct match, multi-character bypass loop - removeCommentPatterns: complete/unclosed HTML, nested, Jinja, JSX-style - Dangerous-tag stripping: complete pairs, lone openers, partial openers - Spacer-attack resistance for <sty<script>...</script>le> and inline-handler reconstruction (Fixes: #6233 regression guard) - Inline on* event handler stripping - Contributors table conversion: well-formed, empty (drops the table), escapeAngle() coverage on all three fields - <img> normalization: no src, missing alt, title preserved - Normalization tail: <br>/<hr>, align/width/height/frameborder/scrolling/ allowfullscreen stripping, class -> className, style stripping, meta/link/ base removal, CDATA/PI/DOCTYPE removal, <sub> unwrap, C0 control stripping, idempotence. Test-only change. Refs #6703. Signed-off-by: quality-agent <quality@kubestellar-hive.local> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: kubestellar-hive[bot] <223556219+Copilot@users.noreply.github.com>
|
Important Held for human sign-off on the direction, not on the code. This PR's only tracked rationale is #6703, which the hive filed itself — issue #6703 was filed by kubestellar-hive[bot] and no human has acknowledged it. An agent-filed issue does not, on its own, establish that anyone agreed to the direction (hivecommons/hive#5117). The change may well be right; nothing here is a review of it. To release the hold, acknowledge the direction on that issue — comment on it, assign yourself, or add the |
kubestellar-prow
Bot
added
the
dco-signoff: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
❌ Deploy Preview for kubestellar-docs failed. Why did it fail? →
|
kubestellar-prow
Bot
added
the
size/L
kubestellar-prow
Bot
added
the
needs-ok-to-test
|
Hi @kubestellar-hive[bot]. Thanks for your PR. I'm waiting for a kubestellar member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| it('loops until stable to catch multi-character bypass (interleaved pattern)', () => { | ||
| // <scr<script>ipt> collapses to <script> after one pass; loop catches it. | ||
| const out = stripUntilStable('<scr<script>ipt>', /<script>/g) |
|
Thank you for your contribution! Your PR has been merged. Check out what's new:
Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey |
Test Improvement
Adds
src/__tests__/sanitizeHtml.test.ts— 33 unit tests forsrc/lib/sanitizeHtml.ts, the primary XSS-defense module that sanitizes user-supplied MDX before it is rendered on the docs site.The module was previously untested by any file in
src/__tests__/even though it is the security-critical layer stripping<script>,<style>,<iframe>, inlineon*event handlers, HTML/Jinja/JSX comments, CDATA, DOCTYPE, and processing instructions, plus normalizing<img>/<br>/<hr>/class=attributes.Coverage
stripUntilStable— no-op, direct match, multi-character bypass loopremoveCommentPatterns— complete, unclosed, nested, Jinja, JSX-style, no-oppartialRepass<sty<script>…</script>le>and inline-handler reconstruction (docs#6233)on*event handler stripping (quoted, unquoted, boolean)escapeAngleon all three fields<img>normalization — no src, missing alt, title preserved<br>/<hr>, attribute stripping,class→className, style, meta/link/base, CDATA/PI/DOCTYPE,<sub>unwrap, C0 control stripping, idempotenceAll 33 tests pass locally with
vitest run.Test-only change; no production files touched.
sanitizeHtml.tsis the file most likely to accumulate silent regressions since sanitization changes are subtle and easy to break — this test suite locks in every documented invariant in the module comments.Refs #6703
Filed by quality agent (ACMM L4/L6 — full mode)
— hive: agent=quality backend=copilot model=claude-opus-4.7