From b3f8fb69a006439bc6133e888daa8c6700a59887 Mon Sep 17 00:00:00 2001 From: mirivlad Date: Fri, 17 Jul 2026 06:04:38 +0800 Subject: [PATCH] test(web): cover confirmation template escaping --- internal/server/web_locale_test.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/internal/server/web_locale_test.go b/internal/server/web_locale_test.go index 1762a60..476b33d 100644 --- a/internal/server/web_locale_test.go +++ b/internal/server/web_locale_test.go @@ -125,6 +125,22 @@ func TestPublicTemplateRoutesRenderInBothLocales(t *testing.T) { } } +func TestConfirmationPageUsesSharedTemplateAndEscapesToken(t *testing.T) { + s, err := newTestServer(t) + if err != nil { + t.Fatal(err) + } + defer s.Close() + s.SetupRoutes() + req := httptest.NewRequest(http.MethodGet, "/api/v1/auth/confirm?token=%3Cscript%3E", nil) + req.AddCookie(&http.Cookie{Name: webLocaleCookieName, Value: "ru"}) + res := httptest.NewRecorder() + s.Handler().ServeHTTP(res, req) + if res.Code != http.StatusOK || !strings.Contains(res.Body.String(), ``) || strings.Contains(res.Body.String(), "