package web
import (
"strings"
"testing"
"git.fabledsword.com/bvandeusen/minstrel/internal/config"
)
const sampleIndexHTML = `
{{ .AppName }}
`
func TestApplyBrandingTemplate_Defaults(t *testing.T) {
out, err := applyBrandingTemplate(sampleIndexHTML, config.BrandingConfig{
AppName: "Minstrel",
Description: "Self-hosted music server.",
})
if err != nil {
t.Fatalf("apply: %v", err)
}
body := string(out)
if !strings.Contains(body, "Minstrel") {
t.Errorf("missing default title; body=%s", body)
}
}
func TestApplyBrandingTemplate_CustomBranding(t *testing.T) {
out, err := applyBrandingTemplate(sampleIndexHTML, config.BrandingConfig{
AppName: "Family Jukebox",
Description: "Our home library.",
})
if err != nil {
t.Fatalf("apply: %v", err)
}
body := string(out)
if !strings.Contains(body, "Family Jukebox") {
t.Errorf("custom AppName not in title; body=%s", body)
}
if !strings.Contains(body, `og:title" content="Family Jukebox"`) {
t.Errorf("custom AppName not in og:title; body=%s", body)
}
if !strings.Contains(body, `appName: "Family Jukebox"`) {
t.Errorf("custom AppName not in inline window.__MINSTREL__; body=%s", body)
}
}
func TestApplyBrandingTemplate_XSSEscape_ScriptContext(t *testing.T) {
// Operator config is trusted, but defensive escaping is still required:
// an operator who doesn't realize their value is interpolated into HTML
// shouldn't be able to accidentally break out of contexts.
out, err := applyBrandingTemplate(sampleIndexHTML, config.BrandingConfig{
AppName: "![]()
",
Description: "ok",
})
if err != nil {
t.Fatalf("apply: %v", err)
}
body := string(out)
scriptOpen := strings.Index(body, "")
if scriptClose < 0 {
t.Fatalf("inline script block has no close; body=%s", body)
}
scriptBody := body[scriptOpen : scriptOpen+scriptClose]
if strings.Contains(scriptBody, "") {
t.Errorf("unescaped inside inline-script context: %s", scriptBody)
}
}
func TestApplyBrandingTemplate_XSSEscape_AttrContext(t *testing.T) {
out, err := applyBrandingTemplate(sampleIndexHTML, config.BrandingConfig{
AppName: `">![]()
`,
Description: "ok",
})
if err != nil {
t.Fatalf("apply: %v", err)
}
body := string(out)
// The unescaped HTML should NOT appear as a live tag in attribute context.
if strings.Contains(body, `">![]()
`) {
t.Errorf("unescaped attribute breakout: %s", body)
}
}