notes.test.ts

apps/worker/test/notes.test.ts

1. /**
2. * User notes ride into pre-rendered pages as serve-time JSON.
3. *
4. * The text is typed by a person and shared with everyone who opens the board,
5. * which makes it the one string on this page an insider could aim at a
6. * colleague's browser. The defence is layered: the page script renders notes
7. * via textContent only, and this file pins the injection layer: a note
8. * containing `</script>` must not be able to end the JSON tag and spill the
9. * rest of itself into the document as markup.
10. */
12. import { describe, expect, it } from 'vitest'
13. import { injectNotes, type BoardNote } from '../src/index.js'
15. const PAGE = '<html><body><p>board</p></body></html>'
16. const note = (text: string): Record<string, BoardNote> => ({
17. 'order:MD2639640': { text, by: 'Rafael Montero', at: '2026-09-01T20:00:00.000Z' },
18. })
20. describe('injectNotes', () => {
21. it('injects the notes as a JSON script tag before </body>', () => {
22. const out = injectNotes(PAGE, note('waiting on the client to confirm colors'))
23. expect(out).toContain('<script id="board-notes" type="application/json">')
24. expect(out).toContain('waiting on the client to confirm colors')
25. expect(out.indexOf('</body>')).toBeGreaterThan(out.indexOf('board-notes'))
26. })
28. it('a note containing </script> cannot break out of the tag', () => {
29. const out = injectNotes(PAGE, note('</script><img src=x onerror=alert(1)>'))
30. // Every `<` in the payload is \u003c-escaped, so the literal sequences the
31. // parser would act on never appear.
32. expect(out).not.toContain('</script><img')
33. expect(out).toContain('\\u003c/script>')
34. })
36. it('no notes still injects an empty object, so the page script can tell "no notes" from "old worker"', () => {
37. const out = injectNotes(PAGE, {})
38. expect(out).toContain('type="application/json">{}</script>')
39. })
40. })