Function TestInjectionAppearanceEscapesMetaAttributes

site/site_test.go:52–118

(t *testing.T)

}

func TestInjectionAppearanceEscapesMetaAttributes(t *testing.T) {
	t.Parallel()

	const (
		applicationName = `Coder"><script>alert(1)</script>`
		logoURL         = `https://example.com/logo.png"><img src=x onerror=alert(1)>`
	)

	tests := []struct {
		name          string
		authenticated bool
	}{
		{
			name: "unauthenticated",
		},
		{
			name:          "authenticated",
			authenticated: true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			siteFS := fstest.MapFS{
				"index.html": &fstest.MapFile{
					Data: []byte(`<meta name="application-name" content="{{ .ApplicationName }}" /><meta property="logo-url" content="{{ .LogoURL }}" />`),
				},
			}
			db, _ := dbtestutil.NewDB(t)
			var appearanceFetcher atomic.Pointer[appearance.Fetcher]
			fetcher := appearance.Fetcher(staticAppearanceFetcher{cfg: codersdk.AppearanceConfig{
				ApplicationName: applicationName,
				LogoURL:         logoURL,
			}})
			appearanceFetcher.Store(&fetcher)
			handler, err := site.New(&site.Options{
				Telemetry:         telemetry.NewNoop(),
				Database:          db,
				SiteFS:            siteFS,
				AppearanceFetcher: &appearanceFetcher,
			})
			require.NoError(t, err)

			r := httptest.NewRequest("GET", "/", nil)
			if tt.authenticated {
				user := dbgen.User(t, db, database.User{})
				_, token := dbgen.APIKey(t, db, database.APIKey{
					UserID:    user.ID,
					ExpiresAt: time.Now().Add(time.Hour),
				})
				r.Header.Set(codersdk.SessionTokenHeader, token)
			}
			rw := httptest.NewRecorder()

			handler.ServeHTTP(rw, r)
			require.Equal(t, http.StatusOK, rw.Code)