lockbitchat
58 lines
2.1 KiB
JavaScript
58 lines
2.1 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
|
|
globalThis.window = {
|
|
DEBUG_MODE: true,
|
|
DEVELOPMENT_MODE: true,
|
|
webpackHotUpdate: {},
|
|
location: {
|
|
hostname: 'localhost',
|
|
search: '?debug'
|
|
}
|
|
};
|
|
|
|
const { EnhancedSecureCryptoUtils } = await import('../src/crypto/EnhancedSecureCryptoUtils.js');
|
|
window.EnhancedSecureCryptoUtils = EnhancedSecureCryptoUtils;
|
|
const { EnhancedSecureWebRTCManager } = await import('../src/network/EnhancedSecureWebRTCManager.js');
|
|
|
|
function createManager() {
|
|
return {
|
|
delivered: [],
|
|
_debugMode: false,
|
|
_secureLog() {},
|
|
_sanitizeIncomingChatMessage: EnhancedSecureWebRTCManager.prototype._sanitizeIncomingChatMessage,
|
|
onMessage(message, type) {
|
|
this.delivered.push({ message, type });
|
|
}
|
|
};
|
|
}
|
|
|
|
// Normal text survives unchanged.
|
|
{
|
|
const manager = createManager();
|
|
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, 'hello secure world', 'received');
|
|
assert.deepEqual(manager.delivered[0], { message: 'hello secure world', type: 'received' });
|
|
}
|
|
|
|
// XSS-like and HTML payloads are sanitized before UI delivery.
|
|
{
|
|
const manager = createManager();
|
|
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, '<script>alert(1)</script>Hello <b>peer</b>', 'received');
|
|
assert.deepEqual(manager.delivered[0], { message: 'Hello peer', type: 'received' });
|
|
}
|
|
|
|
// Event-handler and protocol strings are removed before reaching React state.
|
|
{
|
|
const manager = createManager();
|
|
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, '<img src=x onerror=alert(1)> javascript:alert(1)', 'received');
|
|
assert.deepEqual(manager.delivered[0], { message: 'alert(1)', type: 'received' });
|
|
}
|
|
|
|
// Outgoing/system messages are not altered by the incoming-message gate.
|
|
{
|
|
const manager = createManager();
|
|
EnhancedSecureWebRTCManager.prototype.deliverMessageToUI.call(manager, '<b>system</b>', 'system');
|
|
assert.deepEqual(manager.delivered[0], { message: '<b>system</b>', type: 'system' });
|
|
}
|
|
|
|
console.log('Incoming message sanitization tests passed');
|