jaredandClaude Opus 5
f3119e3dc2
The MSC4133 io.lotus.avatar_decoration value was interpolated into the CDN URL verbatim, letting a room member steer the path/query of a request every viewer's browser makes. Accept only slugs present in the catalog; anything else is treated as no decoration. Unit-tested. Fixes #64 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
87 lines
3.0 KiB
TypeScript
87 lines
3.0 KiB
TypeScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {
|
|
DECORATION_CDN,
|
|
DECORATION_CATEGORIES,
|
|
ALL_DECORATIONS,
|
|
decorationUrl,
|
|
isValidDecorationSlug,
|
|
} from './avatarDecorations';
|
|
|
|
test('decorationUrl builds a CDN png url from the slug', () => {
|
|
assert.equal(decorationUrl('joystick'), `${DECORATION_CDN}/joystick.png`);
|
|
assert.equal(decorationUrl('lotus_flower'), `${DECORATION_CDN}/lotus_flower.png`);
|
|
// slug is used verbatim, no encoding/normalisation
|
|
assert.equal(decorationUrl(''), `${DECORATION_CDN}/.png`);
|
|
});
|
|
|
|
test('DECORATION_CDN is an https url with no trailing slash', () => {
|
|
assert.match(DECORATION_CDN, /^https:\/\//);
|
|
assert.equal(DECORATION_CDN.endsWith('/'), false);
|
|
});
|
|
|
|
test('ALL_DECORATIONS is the flattened set of every category decoration', () => {
|
|
const expectedCount = DECORATION_CATEGORIES.reduce((n, c) => n + c.decorations.length, 0);
|
|
assert.equal(ALL_DECORATIONS.length, expectedCount);
|
|
|
|
// every decoration in a category is present (by reference) in ALL_DECORATIONS
|
|
DECORATION_CATEGORIES.forEach((category) => {
|
|
category.decorations.forEach((decoration) => {
|
|
assert.ok(ALL_DECORATIONS.includes(decoration));
|
|
});
|
|
});
|
|
});
|
|
|
|
test('every category has a non-empty id, label and decorations list', () => {
|
|
DECORATION_CATEGORIES.forEach((category) => {
|
|
assert.equal(typeof category.id, 'string');
|
|
assert.ok(category.id.length > 0);
|
|
assert.equal(typeof category.label, 'string');
|
|
assert.ok(category.label.length > 0);
|
|
assert.ok(Array.isArray(category.decorations));
|
|
assert.ok(category.decorations.length > 0);
|
|
});
|
|
});
|
|
|
|
test('category ids are unique', () => {
|
|
const ids = DECORATION_CATEGORIES.map((c) => c.id);
|
|
assert.equal(new Set(ids).size, ids.length);
|
|
});
|
|
|
|
test('every decoration slug is unique across all categories', () => {
|
|
const slugs = ALL_DECORATIONS.map((d) => d.slug);
|
|
assert.equal(new Set(slugs).size, slugs.length);
|
|
});
|
|
|
|
test('every decoration has a non-empty slug and name', () => {
|
|
ALL_DECORATIONS.forEach((decoration) => {
|
|
assert.equal(typeof decoration.slug, 'string');
|
|
assert.ok(decoration.slug.length > 0);
|
|
assert.equal(typeof decoration.name, 'string');
|
|
assert.ok(decoration.name.length > 0);
|
|
});
|
|
});
|
|
|
|
test('slugs use the snake_case charset (lowercase, digits, underscore)', () => {
|
|
ALL_DECORATIONS.forEach((decoration) => {
|
|
assert.match(decoration.slug, /^[a-z0-9_]+$/, `bad slug: ${decoration.slug}`);
|
|
});
|
|
});
|
|
|
|
test('isValidDecorationSlug: accepts a real catalog slug', () => {
|
|
assert.equal(isValidDecorationSlug('joystick'), true);
|
|
assert.equal(isValidDecorationSlug('lotus_flower'), true);
|
|
});
|
|
|
|
test('isValidDecorationSlug: rejects a path-traversal string', () => {
|
|
assert.equal(isValidDecorationSlug('../../anything'), false);
|
|
});
|
|
|
|
test('isValidDecorationSlug: rejects a slug carrying a query string', () => {
|
|
assert.equal(isValidDecorationSlug('joystick?u=probe'), false);
|
|
});
|
|
|
|
test('isValidDecorationSlug: rejects an empty string', () => {
|
|
assert.equal(isValidDecorationSlug(''), false);
|
|
});
|