58 lines
2.1 KiB
Ruby
58 lines
2.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "rails_helper"
|
|
|
|
RSpec.describe Tournaments::ComposeInviteEmail do
|
|
it "sostituisce i token e rimuove HTML pericoloso" do
|
|
html = <<~HTML
|
|
<p>Ciao custom</p>
|
|
<script>alert(1)</script>
|
|
<p><a href="javascript:alert(1)">x</a></p>
|
|
<p>{{link_invito}}</p>
|
|
<p>Scade il {{scadenza}}</p>
|
|
<img src="javascript:alert(1)">
|
|
<img src="/rails/active_storage/blobs/redirect/abc/logo.png" width="120">
|
|
HTML
|
|
|
|
out = described_class.call(
|
|
html: html,
|
|
invite_url: "https://www.example.com/join/token-ok",
|
|
expires_on: "10 settembre 2026"
|
|
)
|
|
|
|
expect(out).to include("Ciao custom")
|
|
expect(out).to include("https://www.example.com/join/token-ok")
|
|
expect(out).to include("10 settembre 2026")
|
|
expect(out).to include("/rails/active_storage/blobs/redirect/abc/logo.png")
|
|
expect(out).not_to include("<script")
|
|
expect(out).not_to include("javascript:")
|
|
end
|
|
|
|
it "aggiunge il link se l'utente ha cancellato il token" do
|
|
out = described_class.call(html: "<p>Solo testo</p>", invite_url: "https://www.example.com/join/z")
|
|
expect(out).to include("Solo testo")
|
|
expect(out).to include("https://www.example.com/join/z")
|
|
end
|
|
|
|
it "mantiene i token del modello quando sanitizza una bozza" do
|
|
html = %(<p>Bozza</p><p><a href="{{link_invito}}">Apri</a></p><p data-invite-note="">Nota</p>)
|
|
out = described_class.sanitize_html(html)
|
|
expect(out).to include("Bozza")
|
|
expect(out).to include("{{link_invito}}")
|
|
expect(out).to include("Nota")
|
|
expect(out).to include("data-invite-note")
|
|
end
|
|
|
|
it "compone il modello predefinito senza chiavi I18n mancanti" do
|
|
tournament = instance_double(Tournament, name: "Open", club: instance_double(Club, name: "Tigers"))
|
|
invited_by = instance_double(User, name: "Owner")
|
|
html = I18n.with_locale(:it) do
|
|
described_class.default_html(tournament: tournament, invited_by: invited_by)
|
|
end
|
|
expect(html).not_to include("Translation missing")
|
|
expect(html).to include("Open")
|
|
expect(html).to include("Tigers")
|
|
expect(html).to include("{{link_invito}}")
|
|
end
|
|
end
|