-
-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Expand file tree
/
Copy pathimport-guard.test.ts
More file actions
66 lines (55 loc) · 2.65 KB
/
Copy pathimport-guard.test.ts
File metadata and controls
66 lines (55 loc) · 2.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
import { extractImportSources, isPublicAsset } from '../packages/slidev/node/vite/importGuard'
describe('slide-import-guard', () => {
describe('isPublicAsset', () => {
let publicDir: string
beforeAll(() => {
publicDir = mkdtempSync(join(tmpdir(), 'slidev-public-'))
mkdirSync(join(publicDir, 'avatars'), { recursive: true })
writeFileSync(join(publicDir, 'logo.png'), '')
writeFileSync(join(publicDir, 'avatars', 'foo.png'), '')
})
afterAll(() => {
rmSync(publicDir, { recursive: true, force: true })
})
it('exempts a root-absolute URL pointing at an existing public asset', () => {
// The exact case from the bug: `<img src="/logo.png">` compiles to
// `import _imports_0 from '/logo.png'`.
expect(isPublicAsset('/logo.png', { publicDir })).toBe(true)
expect(isPublicAsset('/avatars/foo.png', { publicDir })).toBe(true)
})
it('ignores query and hash suffixes when mapping to disk', () => {
expect(isPublicAsset('/logo.png?url', { publicDir })).toBe(true)
expect(isPublicAsset('/logo.png#frag', { publicDir })).toBe(true)
})
it('does not exempt root-absolute URLs missing from the public dir', () => {
expect(isPublicAsset('/nope.png', { publicDir })).toBe(false)
})
it('does not exempt path-traversal URLs escaping the public dir', () => {
expect(isPublicAsset('/../logo.png', { publicDir })).toBe(false)
expect(isPublicAsset('/../../etc/passwd', { publicDir })).toBe(false)
})
it('does not exempt Vite internal URLs', () => {
expect(isPublicAsset('/@fs/logo.png', { publicDir })).toBe(false)
expect(isPublicAsset('/@id/virtual', { publicDir })).toBe(false)
})
it('does not exempt bare or relative imports', () => {
expect(isPublicAsset('vue', { publicDir })).toBe(false)
expect(isPublicAsset('./local.png', { publicDir })).toBe(false)
expect(isPublicAsset('../local.png', { publicDir })).toBe(false)
})
it('is disabled when publicDir is falsy', () => {
expect(isPublicAsset('/logo.png', { publicDir: '' })).toBe(false)
})
})
describe('extractImportSources', () => {
it('finds the static import the SFC compiler emits for a public img src', () => {
const compiled = `import _imports_0 from '/logo.png'\nexport default {}\n`
const sources = extractImportSources(compiled, 'slides.md__slidev_1.md')
expect(sources.map(s => s.value)).toContain('/logo.png')
})
})
})