mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-04 10:42:23 +00:00
Andras Bacsai
1f4006ac49
Remove tests that copy app logic into the test, grep PHP source as text, only check literals, constants, class_exists or PHP built-ins, duplicate other tests, or are always skipped. Keep source checks that guard security and authorization rules. Rename a duplicate Pest helper so the full suite loads, drop the missing v5/Browser path, and remove the CLAUDE.md symlink in favor of AGENTS.md. Correct AGENTS.md: Dusk is not installed and the upgrade script is scripts/upgrade.sh.
41 lines
1.7 KiB
PHP
41 lines
1.7 KiB
PHP
<?php
|
|
|
|
describe('Log Viewer HTML Tag Preservation', function () {
|
|
it('lets Blade escape deployment log data attributes only once', function () {
|
|
$view = file_get_contents(__DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php');
|
|
|
|
expect($view)
|
|
->toContain('data-log-content="{{ $searchableContent }}"')
|
|
->toContain('data-line-text="{{ $lineContent }}"')
|
|
->not->toContain('data-log-content="{{ htmlspecialchars($searchableContent) }}"')
|
|
->not->toContain('data-line-text="{{ htmlspecialchars($lineContent) }}"');
|
|
});
|
|
});
|
|
|
|
describe('Log Viewer XSS Prevention', function () {
|
|
it('uses text nodes for search highlighting instead of injected html', function () {
|
|
$deploymentView = file_get_contents(__DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php');
|
|
|
|
expect($deploymentView)
|
|
->toContain('document.createTextNode')
|
|
->toContain('mark.textContent')
|
|
->not->toContain('innerHTML')
|
|
->not->toContain('x-html');
|
|
});
|
|
|
|
it('renders runtime log text and highlight segments with x-text only', function () {
|
|
$runtimeView = file_get_contents(__DIR__.'/../../resources/views/livewire/project/shared/get-logs.blade.php');
|
|
$runtimeScript = file_get_contents(__DIR__.'/../../resources/js/runtime-logs.js');
|
|
|
|
expect($runtimeView)
|
|
->toContain('x-text="segment.text"')
|
|
->toContain('x-text="formatLogDetails(row.line.text)"')
|
|
->not->toContain('innerHTML')
|
|
->not->toContain('x-html');
|
|
|
|
expect($runtimeScript)
|
|
->not->toContain('innerHTML')
|
|
->not->toContain('insertAdjacentHTML');
|
|
});
|
|
});
|