import assert from 'node:assert/strict';
import { JSDOM } from 'jsdom';
const { window } = new JSDOM('', {
url: 'http://localhost/?debug'
});
window.DEBUG_MODE = true;
window.DEVELOPMENT_MODE = true;
window.webpackHotUpdate = {};
globalThis.window = window;
const { EnhancedSecureCryptoUtils } = await import('../src/crypto/EnhancedSecureCryptoUtils.js');
window.EnhancedSecureCryptoUtils = EnhancedSecureCryptoUtils;
const { EnhancedSecureWebRTCManager } = await import('../src/network/EnhancedSecureWebRTCManager.js');
function createManager() {
return {
delivered: [],
_debugMode: false,
_secureLog() {},
_sanitizeIncomingChatMessage: EnhancedSecureWebRTCManager.prototype._sanitizeIncomingChatMessage,
onMessage(message, type) {
this.delivered.push({ message, type });
}
};
}
// Normal text survives unchanged.
{
const manager = createManager();
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, 'hello secure world', 'received');
assert.deepEqual(manager.delivered[0], { message: 'hello secure world', type: 'received' });
}
// Script payloads are removed while harmless visible text survives.
{
const manager = createManager();
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, 'Hello peer', 'received');
assert.deepEqual(manager.delivered[0], { message: 'Hello peer', type: 'received' });
}
// Dangerous protocols in markup and event handlers never reach React state.
{
const manager = createManager();
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, 'clickopen ', 'received');
assert.deepEqual(manager.delivered[0], { message: 'clickopen', type: 'received' });
}
// SVG payloads and malformed HTML do not create executable remnants.
{
const manager = createManager();
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, '', 'received');
assert.deepEqual(manager.delivered[0], { message: '', type: 'received' });
const malformedManager = createManager();
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(malformedManager, 'Hello