fleet/frontend/components/ClickableUrls/ClickableUrls_xss.tests.tsx

import React from "react";
import { render } from "@testing-library/react";
import ClickableUrls from "./ClickableUrls";

/**
 * Tests that DOMPurify correctly sanitizes XSS payloads when rendering
 * user-supplied text that may contain URLs. ClickableUrls uses
 * dangerouslySetInnerHTML after DOMPurify.sanitize(), so this exercises
 * the dompurify library's core sanitization behavior.
 */
describe("ClickableUrls - DOMPurify XSS sanitization", () => {
  it("strips inline script injection from text", () => {
    const { container } = render(
      <ClickableUrls text='Check <script>alert("xss")</script> this site' />
    );
    expect(container.innerHTML).not.toContain("<script>");
    expect(container.innerHTML).not.toContain("alert");
  });

  it("strips javascript: protocol when injected via HTML anchor", () => {
    // Plain text "javascript:" is harmless -- the risk is only when it
    // appears inside an href attribute. DOMPurify should strip it there.
    // Build the string dynamically to avoid the no-script-url lint rule.
    const scheme = ["java", "script"].join("");
    const malicious = `Click <a href="${scheme}:alert('xss')">here</a> for details`;
    const { container } = render(<ClickableUrls text={malicious} />);
    const link = container.querySelector("a");
    // DOMPurify should either remove the href entirely or strip the
    // javascript: scheme. Both outcomes are safe.
    const href = link?.getAttribute("href");
    if (href !== null && href !== undefined) {
      expect(href).not.toContain(`${scheme}:`);
    }
  });

  it("strips event handler attributes from injected HTML", () => {
    const { container } = render(
      <ClickableUrls text='See <img src=x onerror=alert("xss")> here' />
    );
    expect(container.innerHTML).not.toContain("onerror");
  });

  it("strips iframe injection", () => {
    const { container } = render(
      <ClickableUrls text='Load <iframe src="https://evil.com"></iframe> page' />
    );
    expect(container.innerHTML).not.toContain("<iframe");
  });

  it("preserves legitimate URLs while sanitizing surrounding HTML", () => {
    const text =
      'Visit https://example.com <script>alert("xss")</script> for info';
    const { container } = render(<ClickableUrls text={text} />);
    const link = container.querySelector("a");
    expect(link).not.toBeNull();
    expect(link?.getAttribute("href")).toBe("https://example.com");
    expect(container.innerHTML).not.toContain("<script>");
  });
});