verstak
/
verstak-sync-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

test(web): cover confirmation template escaping

This commit is contained in:
mirivlad 2026-07-17 06:04:38 +08:00
parent 513675c852
commit b3f8fb69a0
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
internal/server/web_locale_test.go
View File

@ -125,6 +125,22 @@ func TestPublicTemplateRoutesRenderInBothLocales(t *testing.T) {
}
}
func TestConfirmationPageUsesSharedTemplateAndEscapesToken(t *testing.T) {
s, err := newTestServer(t)
if err != nil {
t.Fatal(err)
}
defer s.Close()
s.SetupRoutes()
req := httptest.NewRequest(http.MethodGet, "/api/v1/auth/confirm?token=%3Cscript%3E", nil)
req.AddCookie(&http.Cookie{Name: webLocaleCookieName, Value: "ru"})
res := httptest.NewRecorder()
s.Handler().ServeHTTP(res, req)
if res.Code != http.StatusOK || !strings.Contains(res.Body.String(), `<html lang="ru">`) || strings.Contains(res.Body.String(), "<script>") {
t.Fatalf("confirmation template/escaping failure: %d %s", res.Code, res.Body.String())
}
}
func TestWebSessionScopesDoNotCrossAuthorizePages(t *testing.T) {
s, err := newTestServer(t)
if err != nil {