mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-15 19:32:21 +02:00
Alexandre TeixeiraandLéo
f1a47f3812
* refactor(notes): decompose Notes into feature-owned modules * fix(notes): avoid HTML interpolation in reminder picker * docs(notes): drop checkpoint archives, session logs and publication drafts The N0-N6 tarballs and raw pytest/node logs are not read by any script or test, and the logs carry absolute home-directory paths. Once squashed into dev they would stay in history for good. notes-pr.md and notes-issue.md were the drafts used to open #6712 and #6713, not documentation. notes-validation.md keeps the counts, the checkpoint hashes and implementation.sha256 as the record; local interpreter paths and the local Docker image name are replaced with portable placeholders. * fix(notes): keep the state store raw and stop masonry re-observing after close - state: writes built from views (filter, spread, splice) stored nested read-only views in the store, so structuredClone on a stored note threw DataCloneError. Store writes now unwrap nested views. - layout: a save that resolves after closePanel re-renders the leaving pane and re-created the masonry ResizeObserver that teardown had disposed. Skip creating it once Notes is closed. - index.js: drop 30 imported or declared names that were never used and group the imports at the top. Import order is unchanged. - Revert unrelated punctuation edits in .gitattributes and keep the header comment and docstring first in compare/vote.js and test_notes_dom_xss_helpers.py. Both fixes have a node test that fails on the previous head. * test(notes): make script rejection assertion case-insensitive Address CodeQL js/bad-tag-filter alert #1150 in test-only assertion and refresh Notes evidence manifest checksum. --------- Co-authored-by: Léo <leograndcontact@gmail.com>
37 lines
1.4 KiB
Python
37 lines
1.4 KiB
Python
"""Regression guards for Notes DOM rendering helpers."""
|
|
|
|
from pathlib import Path
|
|
|
|
from tests.helpers.notes_source import notes_source
|
|
|
|
|
|
_REPO = Path(__file__).resolve().parent.parent
|
|
|
|
|
|
def test_notes_image_src_guard_rejects_script_capable_data_images():
|
|
src = notes_source("ui/text", "ui/editor", "ui/drawing")
|
|
|
|
assert "function _safeImgSrc(s)" in src
|
|
assert r"^data:image\/(?:png|jpe?g|gif|webp);base64," in src
|
|
assert r"^data:image\/i.test(v)" not in src
|
|
|
|
|
|
def test_notes_linkify_escapes_href_attribute():
|
|
src = notes_source("ui/text", "ui/editor", "ui/drawing")
|
|
|
|
assert "function _attrEsc(s)" in src
|
|
assert 'href="${_attrEsc(href)}"' in src
|
|
assert 'href="${href}"' not in src
|
|
|
|
|
|
def test_notes_edit_form_uses_safe_image_src_guard():
|
|
src = notes_source("ui/text", "ui/editor", "ui/drawing")
|
|
|
|
assert "let currentImageUrl = _safeImgSrc(note?.image_url || '');" in src
|
|
assert "let _stashedDrawUrl = (type === 'draw') ? (_safeImgSrc(note?.image_url) || null) : null;" in src
|
|
assert "_wireCanvas(bodyEl, _stashedDrawUrl || currentImageUrl || _safeImgSrc(note?.image_url) || null)" in src
|
|
assert "_wireCanvas(form.querySelector('.note-form-body'), _safeImgSrc(note?.image_url) || null)" in src
|
|
assert "const safeInitialImageUrl = _safeImgSrc(initialImageUrl);" in src
|
|
assert "img.src = safeInitialImageUrl;" in src
|
|
assert "img.src = initialImageUrl;" not in src
|