import { describe, it } from "node:test"; import assert from "node:assert/strict"; import "../test-setup.mjs"; // Setup JSDOM import { escapeHTML, removeTrackingScripts } from "../../js/utils/domUtils.js"; describe("domUtils", () => { describe("escapeHTML", () => { it("should return empty string for null or undefined", () => { assert.equal(escapeHTML(null), ""); assert.equal(escapeHTML(undefined), ""); }); it("should return the string as is if no special characters are present", () => { assert.equal(escapeHTML("hello world"), "hello world"); assert.equal(escapeHTML("12345"), "12345"); }); it("should escape special characters", () => { assert.equal(escapeHTML("&"), "&"); assert.equal(escapeHTML("<"), "<"); assert.equal(escapeHTML(">"), ">"); assert.equal(escapeHTML('"'), """); assert.equal(escapeHTML("'"), "'"); }); it("should escape multiple occurrences of special characters", () => { assert.equal(escapeHTML(""), "<script>alert('xss')</script>"); assert.equal(escapeHTML("foo & bar & baz"), "foo & bar & baz"); }); it("should handle mixed content correctly", () => { const input = '
It\'s me & you
'; const expected = '<div class="test">It's me & you</div>'; assert.equal(escapeHTML(input), expected); }); it("should convert non-string inputs to string and escape", () => { assert.equal(escapeHTML(123), "123"); // This behavior depends on String(obj), but let's test a simple object if needed. // Ideally escapeHTML expects a string, but the implementation does String(unsafe). assert.equal(escapeHTML(true), "true"); }); }); describe("removeTrackingScripts", () => { it("should do nothing if root is null or undefined", () => { // Should not throw removeTrackingScripts(null); removeTrackingScripts(undefined); }); it("should do nothing if root has no querySelectorAll", () => { removeTrackingScripts({}); }); it("should remove scripts matching the tracking pattern", () => { const container = document.createElement("div"); const trackScript = document.createElement("script"); trackScript.src = "https://example.com/tracking.js"; container.appendChild(trackScript); const trackScript2 = document.createElement("script"); trackScript2.src = "/tracking.js?id=123"; container.appendChild(trackScript2); const safeScript = document.createElement("script"); safeScript.src = "https://example.com/app.js"; container.appendChild(safeScript); removeTrackingScripts(container); assert.equal(container.querySelectorAll("script").length, 1); assert.equal(container.querySelector("script").src, "https://example.com/app.js"); }); it("should not remove inline scripts (no src)", () => { const container = document.createElement("div"); const inlineScript = document.createElement("script"); inlineScript.textContent = "console.log('hello')"; container.appendChild(inlineScript); removeTrackingScripts(container); assert.equal(container.querySelectorAll("script").length, 1); assert.equal(container.querySelector("script").textContent, "console.log('hello')"); }); it("should remove scripts where src ends with tracking.js", () => { const container = document.createElement("div"); const script = document.createElement("script"); script.src = "http://bad.com/tracking.js"; container.appendChild(script); removeTrackingScripts(container); assert.equal(container.querySelectorAll("script").length, 0); }); it("should remove scripts where src contains /tracking.js", () => { const container = document.createElement("div"); const script = document.createElement("script"); script.src = "http://bad.com/js/tracking.js?v=1"; container.appendChild(script); removeTrackingScripts(container); assert.equal(container.querySelectorAll("script").length, 0); }); }); });