Add unit tests for HTML sanitization, link safety, page titles, and conditional report navigation

Author: coderabbitai[bot]

tests/unit/html5-attributes.test.js

@@ -82,6 +82,20 @@ describe('HTML5 attribute compliance (sources)', () => {
     expect(html).toContain('<td>');
   });
 
+  for (const attribute of OBSOLETE_ATTRIBUTES) {
+    it(`strips the obsolete ${attribute} attribute from rendered markup`, () => {
+      const html = renderTemplate(
+        `<div id="subject" ${attribute}="legacy-value">content</div>`,
+        {}
+      );
+      const subject = new JSDOM(html).window.document.querySelector('#subject');
+
+      expect(subject).not.toBeNull();
+      expect(subject.hasAttribute(attribute)).toBe(false);
+      expect(subject.textContent).toBe('content');
+    });
+  }
+
   it('preserves valid ordered-list numbering', () => {
     const html = renderTemplate('<ol start="3"><li>Third</li></ol>', {});
     const list = new JSDOM(html).window.document.querySelector('ol');

tests/unit/page-titles.test.js

@@ -16,6 +16,18 @@ const PAGES = {
   'terms-of-service': () => import('../../app/terms-of-service/page.jsx')
 };
 
+const CHANGED_PAGE_TITLES = {
+  about: 'About - RefactorFirst',
+  api: 'API - RefactorFirst',
+  documentation: 'Documentation - RefactorFirst',
+  examples: 'Example Reports - RefactorFirst',
+  faq: 'FAQ - RefactorFirst',
+  feedback: 'Feedback - RefactorFirst',
+  'getting-started': 'Getting Started - RefactorFirst',
+  'privacy-policy': 'Privacy Policy - RefactorFirst',
+  'terms-of-service': 'Terms of Service - RefactorFirst'
+};
+
 describe('static page titles (WCAG 2.4.2)', () => {
   it('every static page exports a descriptive, unique title', async () => {
     const titles = new Map();
@@ -33,4 +45,11 @@ describe('static page titles (WCAG 2.4.2)', () => {
       titles.set(title, route);
     }
   });
+
+  it('uses the expected page-specific title before the site name', async () => {
+    for (const [route, expectedTitle] of Object.entries(CHANGED_PAGE_TITLES)) {
+      const mod = await PAGES[route]();
+      expect(mod.metadata.title).toBe(expectedTitle);
+    }
+  });
 });

tests/unit/renderer.test.js

@@ -67,6 +67,29 @@ describe('Mustache Rendering', () => {
     expect(result).toContain('<p>safe</p>');
   })
 
+  const forbiddenElements = [
+    ['script', '<script>window.__xss = 1</script>'],
+    ['iframe', '<iframe src="https://evil.example"></iframe>'],
+    ['object', '<object data="https://evil.example/payload"></object>'],
+    ['embed', '<embed src="https://evil.example/payload">'],
+    ['meta', '<meta http-equiv="refresh" content="0;url=https://evil.example">'],
+    ['link', '<link rel="stylesheet" href="https://evil.example/styles.css">'],
+    ['form', '<form action="https://evil.example"><button>Submit</button></form>'],
+    ['input', '<input name="secret" value="credential">'],
+    ['select', '<select name="secret"><option>credential</option></select>'],
+    ['textarea', '<textarea name="secret">credential</textarea>']
+  ];
+
+  for (const [tag, markup] of forbiddenElements) {
+    it(`strips forbidden <${tag}> elements from raw interpolations`, () => {
+      const html = renderTemplate('<section>{{{content}}}</section>', { content: markup });
+      const document = new JSDOM(html).window.document;
+
+      expect(document.querySelector(tag)).toBeNull();
+      expect(document.querySelector('section')).not.toBeNull();
+    });
+  }
+
   it('should handle empty data', () => {
     const template = '{{name}}';
     const result = renderTemplate(template, {});
@@ -128,6 +151,19 @@ describe('templating safety (repository-provided templates are untrusted)', () =
     expect(document.querySelector('div[target="_blank"]')?.hasAttribute('rel')).toBe(false);
   });
 
+  it('removes an explicit opener relationship from links that open a new context', () => {
+    const html = renderTemplate(
+      '<a href="https://example.com" target="_blank" rel="opener nofollow">New tab</a>',
+      {}
+    );
+    const link = new JSDOM(html).window.document.querySelector('a');
+    const relationships = link.getAttribute('rel').split(/\s+/);
+
+    expect(relationships).toContain('noopener');
+    expect(relationships).toContain('noreferrer');
+    expect(relationships).not.toContain('opener');
+  });
+
   it('keeps benign structure, style attributes and data attributes intact', () => {
     const html = renderTemplate(
       '<div id="popup-classGraph" style="width: 100%;"><span class="close-btn">&times;</span></div>',

tests/unit/report-template-wcag.test.js

@@ -115,4 +115,31 @@ describe('report template WCAG 2.2 AA (rendered with fixture data)', () => {
 
     expect(docWithoutCycleMap.querySelector('a[href="#CYCLEMAP"]')).toBeNull();
   });
+
+  it('omits optional navigation links when their report sections are absent', () => {
+    const sparseFixture = structuredClone(fixture);
+    sparseFixture.classRelationshipsToRemove.hasRelationships = false;
+    sparseFixture.packageMap.hasEdges = false;
+    sparseFixture.packageRelationshipsToRemove.hasRelationships = false;
+    sparseFixture.hasDisharmonies = false;
+    sparseFixture.disharmonies = [];
+    sparseFixture.classCycles.hasCycles = false;
+
+    const sparseDoc = new JSDOM(renderTemplate(template, sparseFixture)).window.document;
+    const optionalTargets = [
+      '#CLASSEDGES',
+      '#PACKAGEMAP',
+      '#PACKAGEEDGES',
+      '#DISHARMONIES',
+      '#CYCLES',
+      '#CYCLEMAP'
+    ];
+
+    expect(sparseDoc.querySelector('a[href="#CLASSMAP"]')).not.toBeNull();
+    expect(sparseDoc.getElementById('CLASSMAP')).not.toBeNull();
+    for (const target of optionalTargets) {
+      expect(sparseDoc.querySelector(`a[href="${target}"]`)).toBeNull();
+      expect(sparseDoc.getElementById(target.slice(1))).toBeNull();
+    }
+  });
 });