package security // Tests for input sanitization utilities and validation helpers. import ( "regexp" "strings" "testing" "unicode/utf8" "github.com/stretchr/testify/require" ) // TestSanitize_Options ensures sanitize options behavior is handled correctly. func TestSanitize_Options(t *testing.T) { opts := SanitizeOptions{ TrimWhitespace: true, RemoveMultipleSpaces: true, HTMLEscape: true, MaxLength: 0, AllowedPattern: nil, } result := Sanitize(" Hello World ", opts) require.Equal(t, "Hello <b>World</b>", result) opts.MaxLength = 5 require.Equal(t, "Hello", Sanitize("Hello World", opts)) opts.AllowedPattern = regexp.MustCompile(`^[a-z]+$`) require.Equal(t, "", Sanitize("Hello123", opts)) } // TestSanitizePlayerName ensures sanitize player name behavior is handled correctly. func TestSanitizePlayerName(t *testing.T) { require.Equal(t, "Alice Bob", SanitizePlayerName(" Alice Bob ")) require.Equal(t, "", SanitizePlayerName("Alice <")) } // TestSanitizeAnswer ensures sanitize answer behavior is handled correctly. func TestSanitizeAnswer(t *testing.T) { require.Equal(t, "hello", SanitizeAnswer(" HeLLo ")) } // TestSanitizeQuestionText ensures sanitize question text behavior is handled correctly. func TestSanitizeQuestionText(t *testing.T) { result := SanitizeQuestionText(" Question") require.NotContains(t, result, "Hi")) } // TestContainsDangerousPatterns ensures contains dangerous patterns behavior is handled correctly. func TestContainsDangerousPatterns(t *testing.T) { cases := []struct { name string input string expected bool }{ {name: "javascript", input: "javascript:alert(1)", expected: true}, {name: "mixed_case_javascript", input: "JaVaScRiPt:alert(1)", expected: true}, {name: "data", input: "data:text/html;base64,abc", expected: true}, {name: "vbscript", input: "vbscript:msgbox(1)", expected: true}, {name: "onerror", input: `

`, expected: true}, {name: "onload", input: ``, expected: true}, {name: "onclick", input: `link`, expected: true}, {name: "onmouseover", input: `

`, expected: true}, {name: "benign", input: "hello", expected: false}, {name: "benign_near_miss_1", input: "onboarding flow", expected: false}, {name: "benign_near_miss_2", input: "scripture reference", expected: false}, } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { require.Equal(t, tc.expected, ContainsDangerousPatterns(tc.input)) }) } } // TestIsValidEmail ensures is valid email behavior is handled correctly. func TestIsValidEmail(t *testing.T) { require.True(t, IsValidEmail("a@b.com")) require.False(t, IsValidEmail("bad@")) } // TestSanitizeRuneSafeClamping ensures sanitize rune safe clamping behavior is handled correctly. func TestSanitizeRuneSafeClamping(t *testing.T) { input := strings.Repeat("é", 5) opts := SanitizeOptions{ TrimWhitespace: false, RemoveMultipleSpaces: false, HTMLEscape: false, MaxLength: 3, } result := Sanitize(input, opts) require.True(t, utf8.ValidString(result)) require.Equal(t, 3, utf8.RuneCountInString(result)) require.Equal(t, "ééé", result) }