fastboot/test/fastboot-shoebox-test.js at 9a4aa1cae507d7cff423a16752976ab2676e5607 · ember-fastboot/fastboot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
'use strict';

const expect = require('chai').expect;
const fs = require('fs');
const path = require('path');
const fixture = require('./helpers/fixture-path');
const FastBoot = require('./../src/index');

describe("FastBootShoebox", function() {

  it("can render the escaped shoebox HTML", function() {
    var fastboot = new FastBoot({
      distPath: fixture('shoebox')
    });

    return fastboot.visit('/')
      .then(r => r.html())
      .then(html => {
        expect(html).to.match(/<script type="fastboot\/shoebox" id="shoebox-key1">{"foo":"bar"}<\/script>/);
        expect(html).to.match(/<script type="fastboot\/shoebox" id="shoebox-key2">{"zip":"zap"}<\/script>/);

        // Special characters are JSON encoded, most notably the </script sequence.
        expect(html).to.include('<script type="fastboot/shoebox" id="shoebox-key4">{"nastyScriptCase":"\\u003cscript\\u003ealert(\'owned\');\\u003c/script\\u003e\\u003c/script\\u003e\\u003c/script\\u003e"}</script>');

        expect(html).to.include('<script type="fastboot/shoebox" id="shoebox-key5">{"otherUnicodeChars":"\\u0026\\u0026\\u003e\\u003e\\u003c\\u003c\\u2028\\u2028\\u2029\\u2029"}</script>');

        // ignores undefined
        expect(html).to.not.include('shoebox-key6');
      });
  });

  it("can render the escaped shoebox HTML with shouldRender set to false", function() {
    var fastboot = new FastBoot({
      distPath: fixture('shoebox')
    });

    return fastboot.visit('/', {
      shouldRender: false
    })
      .then(r => r.html())
      .then(html => {
        expect(html).to.match(/<script type="fastboot\/shoebox" id="shoebox-key1">{"foo":"bar"}<\/script>/);
        expect(html).to.match(/<script type="fastboot\/shoebox" id="shoebox-key2">{"zip":"zap"}<\/script>/);

        // Special characters are JSON encoded, most notably the </script sequence.
        expect(html).to.include('<script type="fastboot/shoebox" id="shoebox-key4">{"nastyScriptCase":"\\u003cscript\\u003ealert(\'owned\');\\u003c/script\\u003e\\u003c/script\\u003e\\u003c/script\\u003e"}</script>');

        expect(html).to.include('<script type="fastboot/shoebox" id="shoebox-key5">{"otherUnicodeChars":"\\u0026\\u0026\\u003e\\u003e\\u003c\\u003c\\u2028\\u2028\\u2029\\u2029"}</script>');

        // ignores undefined
        expect(html).to.not.include('shoebox-key6');
      });
  });

  it("cannot render the escaped shoebox HTML when disableShoebox is set to true", function() {
    var fastboot = new FastBoot({
      distPath: fixture('shoebox')
    });

    return fastboot.visit('/', {
      disableShoebox: true
    })
      .then(r => r.html())
      .then(html => {
        expect(html).to.not.match(/<script type="fastboot\/shoebox" id="shoebox-key1">{"foo":"bar"}<\/script>/);
        expect(html).to.not.match(/<script type="fastboot\/shoebox" id="shoebox-key2">{"zip":"zap"}<\/script>/);

        // Special characters are JSON encoded, most notably the </script sequence.
        expect(html).to.not.include('<script type="fastboot/shoebox" id="shoebox-key4">{"nastyScriptCase":"\\u003cscript\\u003ealert(\'owned\');\\u003c/script\\u003e\\u003c/script\\u003e\\u003c/script\\u003e"}</script>');

        expect(html).to.not.include('<script type="fastboot/shoebox" id="shoebox-key5">{"otherUnicodeChars":"\\u0026\\u0026\\u003e\\u003e\\u003c\\u003c\\u2028\\u2028\\u2029\\u2029"}</script>');

        // ignores undefined
        expect(html).to.not.include('shoebox-key6');
      });
  });
});