render_test.gno

 1package user
 2
 3import (
 4	"net/url"
 5	"strings"
 6	"testing"
 7
 8	"gno.land/p/nt/uassert/v0"
 9)
10
11func TestRenderEscapesMarkdownSensitiveUserValues(cur realm, t *testing.T) {
12	setupUserTests(cross(cur), t)
13
14	nickname := "N [x](y) **b**"
15	intro := "**bold** [link](https://example.invalid)\n# heading"
16
17	createUserForTest(cross(cur), regularUser)
18	testing.SetOriginCaller(testAdmin)
19	testing.SetRealm(testing.NewUserRealm(testAdmin))
20	AdminUpdateUser(cross(cur), regularUser, "nickname,introduction", url.PathEscape(nickname)+","+url.PathEscape(intro))
21
22	detail := Render("user?address=" + regularUser.String())
23	uassert.True(t, strings.Contains(detail, `N \[x\]\(y\) \*\*b\*\*`), "nickname should be escaped")
24	uassert.True(t, strings.Contains(detail, `\*\*bold\*\* \[link\]\(https://example\.invalid\)\n\# heading`), "property value should be escaped")
25	uassert.False(t, strings.Contains(detail, "[link](https://example.invalid)"), "property link syntax should not remain raw")
26	uassert.False(t, strings.Contains(detail, "\n# heading"), "property newline heading should not remain raw")
27
28	list := Render("users")
29	uassert.True(t, strings.Contains(list, `N \[x\]\(y\) \*\*b\*\*`), "list nickname should be escaped")
30	uassert.False(t, strings.Contains(list, "[profile](profile-page)"), "list nickname link syntax should not remain raw")
31}
32
33func TestRenderErrors(cur realm, t *testing.T) {
34	setupUserTests(cross(cur), t)
35
36	invalid := Render("user?address=invalid-address")
37	uassert.True(t, strings.Contains(invalid, "Invalid address"), "render output should contain expected error")
38
39	missing := Render("user?address=" + regularUser.String())
40	uassert.True(t, strings.Contains(missing, "User not found"), "missing user should render not found")
41
42	unknown := Render("nickname?nickname=alice")
43	uassert.True(t, strings.Contains(unknown, "Not found"), "removed nickname route should 404")
44}
45
46func TestRenderUserSanitizesPageLink(cur realm, t *testing.T) {
47	setupUserTests(cross(cur), t)
48	createUserForTest(cross(cur), regularUser)
49
50	valid := Render("user?address=" + regularUser.String() + "&page=02")
51	uassert.True(t, strings.Contains(valid, "[← Back to List](./user:users?page=2)"), "valid page should be normalized")
52
53	injected := Render("user?address=" + regularUser.String() + "&page=1%29%5D%28https%3A%2F%2Fexample.invalid%29")
54	uassert.False(t, strings.Contains(injected, "example.invalid"), "invalid page should not be reflected")
55	uassert.False(t, strings.Contains(injected, "users?page="), "invalid page should not render a page back link")
56	uassert.True(t, strings.Contains(injected, "[← Home](./user:)"), "invalid page should fall back to home link")
57}
58
59func TestRenderRejectsOversizedURL(cur realm, t *testing.T) {
60	uassert.PanicsWithMessage(t, cur, "url exceeds max runes", func() {
61		Render(strings.Repeat("a", renderURLMaxRunes+1))
62	})
63	Render(strings.Repeat("a", renderURLMaxRunes))
64}
65
66func TestRenderHomeUsesRelativeBrowseUsersLink(cur realm, t *testing.T) {
67	setupUserTests(cross(cur), t)
68
69	output := Render("")
70
71	uassert.True(t, strings.Contains(output, "* [Browse Users](./user:users)"), "should use package-relative users link")
72	uassert.False(t, strings.Contains(output, "* [Browse Users](users)"), "should not use path-relative users link")
73	uassert.False(t, strings.Contains(output, "* [Browse Users](/r/akkadia/user:users)"), "should not use absolute users link")
74}