20 lines
985 B
TypeScript
20 lines
985 B
TypeScript
import { describe, expect, test } from "vitest";
|
|
|
|
import { getSafeAssistantMarkdownImageSource } from "./assistant-markdown-image";
|
|
|
|
describe("getSafeAssistantMarkdownImageSource", () => {
|
|
test("allows Homarr-relative and ordinary remote images", () => {
|
|
expect(getSafeAssistantMarkdownImageSource("/logo/logo.png")).toBe("/logo/logo.png");
|
|
expect(getSafeAssistantMarkdownImageSource("https://cdn.example.com/icons/discord.svg")).toBe(
|
|
"https://cdn.example.com/icons/discord.svg",
|
|
);
|
|
});
|
|
|
|
test("rejects unsafe protocols, protocol-relative URLs, and embedded credentials", () => {
|
|
expect(getSafeAssistantMarkdownImageSource("javascript:alert(1)")).toBeNull();
|
|
expect(getSafeAssistantMarkdownImageSource("data:image/svg+xml;base64,PHN2Zy8+")).toBeNull();
|
|
expect(getSafeAssistantMarkdownImageSource("//example.com/icon.svg")).toBeNull();
|
|
expect(getSafeAssistantMarkdownImageSource("https://user:secret@example.com/icon.svg")).toBeNull();
|
|
});
|
|
});
|