35 lines
1.2 KiB
TypeScript
35 lines
1.2 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { getAllowedPermissions, getFrameTitle, getSandboxFlags, isSupportedProtocol } from "./component";
|
|
|
|
const permissions = {
|
|
allowFullScreen: true,
|
|
allowPayment: false,
|
|
allowAutoPlay: true,
|
|
allowMicrophone: false,
|
|
allowCamera: false,
|
|
allowGeolocation: false,
|
|
allowModals: true,
|
|
};
|
|
|
|
describe("iframe policy", () => {
|
|
it("keeps sandbox-only modal permission out of Permissions Policy", () => {
|
|
expect(getAllowedPermissions(permissions)).toBe("fullscreen *; autoplay *");
|
|
expect(getSandboxFlags(permissions)).toContain("allow-modals");
|
|
});
|
|
|
|
it("accepts only HTTP protocols", () => {
|
|
expect(isSupportedProtocol("https://example.com")).toBe(true);
|
|
expect(isSupportedProtocol("javascript:alert(1)")).toBe(false);
|
|
expect(isSupportedProtocol("not a url")).toBe(false);
|
|
});
|
|
|
|
it("creates a display title without credentials, paths, or query parameters", () => {
|
|
expect(getFrameTitle("https://user:secret@example.com/private?token=sensitive")).toBe("example.com");
|
|
});
|
|
|
|
it("keeps a non-default port in the display title", () => {
|
|
expect(getFrameTitle("http://user:secret@example.com:8080/private?token=sensitive")).toBe("example.com:8080");
|
|
});
|
|
});
|