mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-12 15:53:46 -04:00
Andras BacsaiandClaude Opus 5.5
a70e856882
- Remove tests that only check markup, CSS, static text, wire:key strings, framework behavior, copied app logic, or expect(true) - Replace source-grep and Reflection checks of security fixes with tests that run the real code (shell quoting, locked properties, 403 checks, webhook fork trust, log redaction, Sentinel token cleanup) - Assert response bodies and unchanged data on API error paths - Run the Traefik version job through handle() instead of private methods - Update stale tests for scheduled task props, the default Postgres image, and the disabled transfer link of unvalidated servers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.1 KiB
PHP
29 lines
1.1 KiB
PHP
<?php
|
|
|
|
describe('Log Viewer XSS Prevention', function () {
|
|
it('uses text nodes for search highlighting instead of injected html', function () {
|
|
$deploymentView = file_get_contents(__DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php');
|
|
|
|
expect($deploymentView)
|
|
->toContain('document.createTextNode')
|
|
->toContain('mark.textContent')
|
|
->not->toContain('innerHTML')
|
|
->not->toContain('x-html');
|
|
});
|
|
|
|
it('renders runtime log text and highlight segments with x-text only', function () {
|
|
$runtimeView = file_get_contents(__DIR__.'/../../resources/views/livewire/project/shared/get-logs.blade.php');
|
|
$runtimeScript = file_get_contents(__DIR__.'/../../resources/js/runtime-logs.js');
|
|
|
|
expect($runtimeView)
|
|
->toContain('x-text="segment.text"')
|
|
->toContain('x-text="formatLogDetails(row.line.text)"')
|
|
->not->toContain('innerHTML')
|
|
->not->toContain('x-html');
|
|
|
|
expect($runtimeScript)
|
|
->not->toContain('innerHTML')
|
|
->not->toContain('insertAdjacentHTML');
|
|
});
|
|
});
|