biss
38e42ad734
GET /api/public/notices/{id}
SQLite / MySQL 双数据库只读连接
.env 与现有数据库配置兼容
公告 HTML 安全清洗
学校、班级、考试、科目、报名及系统通知聚合
46 lines
1.9 KiB
C#
46 lines
1.9 KiB
C#
using Eis.Infrastructure.Public;
|
|
|
|
namespace Eis.Infrastructure.Tests.Public;
|
|
|
|
public sealed class NoticeContentFormatterTests
|
|
{
|
|
private readonly NoticeContentFormatter _formatter = new();
|
|
|
|
[Fact]
|
|
public void Sanitize_RemovesExecutableMarkupAndUnsafeAttributes()
|
|
{
|
|
const string source = "<p onclick=\"alert(1)\">正文<script>alert(1)</script><a href=\"javascript:alert(1)\">链接</a></p>";
|
|
|
|
var result = _formatter.Sanitize(source);
|
|
|
|
Assert.Contains("正文", result, StringComparison.Ordinal);
|
|
Assert.Contains("链接", result, StringComparison.Ordinal);
|
|
Assert.DoesNotContain("script", result, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("onclick", result, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("javascript:", result, StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
[Fact]
|
|
public void Sanitize_PreservesSupportedEditorMarkupAndHardensLinks()
|
|
{
|
|
const string source = "<figure class=\"image unknown\"><img src=\"https://example.test/a.png\" alt=\"图\"><figcaption>说明</figcaption></figure><a href=\"https://example.test\" target=\"_blank\">详情</a>";
|
|
|
|
var result = _formatter.Sanitize(source);
|
|
|
|
Assert.Contains("class=\"image\"", result, StringComparison.Ordinal);
|
|
Assert.DoesNotContain("unknown", result, StringComparison.Ordinal);
|
|
Assert.Contains("src=\"https://example.test/a.png\"", result, StringComparison.Ordinal);
|
|
Assert.Contains("rel=\"noopener noreferrer\"", result, StringComparison.Ordinal);
|
|
}
|
|
|
|
[Fact]
|
|
public void ContentHtml_ConvertsPlainTextParagraphsWithoutTrustingMarkup()
|
|
{
|
|
const string source = "第一段\n换行\n\n第二段 & 内容";
|
|
|
|
var result = _formatter.ContentHtml(source);
|
|
|
|
Assert.Equal("<p>第一段<br>换行</p><p>第二段 & 内容</p>", result);
|
|
}
|
|
}
|