cd88c808b0
Static safety/lint runner for the BlockNinja codebase. ~25 invariant
checks across Go and frontend sources. Was at git.dev.alexdunmow.com:block/ninja
in backend/cmd/check-safety/ until the 2026-06-06 consolidation moved
the BlockNinja repos under a shared ~/src/blockninja/ parent.
This repo is the standalone extraction:
- Own go.mod (git.dev.alexdunmow.com/block/check-safety, go 1.26.4)
- Vendored internal/{helpers,theme} from CMS (Go's internal/ rule
blocks cross-module imports; vendoring is the workaround)
- CLI contract unchanged: `check-safety <target-dir> [--flags]`
- CMS Makefile shells into ../check-safety for safety-check /
install-safety-checker targets
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
121 lines
2.5 KiB
Go
121 lines
2.5 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestCheckHTMLSanitize_RegexStrip(t *testing.T) {
|
|
dir := t.TempDir()
|
|
writeFile(t, dir, "bad.go", `package foo
|
|
|
|
import "regexp"
|
|
|
|
func clean(s string) string {
|
|
re := regexp.MustCompile(`+"`"+`<[^>]*>`+"`"+`)
|
|
return re.ReplaceAllString(s, "")
|
|
}
|
|
`)
|
|
vs := checkHTMLSanitize(dir)
|
|
if len(vs) == 0 {
|
|
t.Fatal("expected regex-html-strip violation")
|
|
}
|
|
if vs[0].rule != "regex-html-strip" {
|
|
t.Fatalf("expected rule regex-html-strip, got %s", vs[0].rule)
|
|
}
|
|
}
|
|
|
|
func TestCheckHTMLSanitize_ScriptRegex(t *testing.T) {
|
|
dir := t.TempDir()
|
|
writeFile(t, dir, "bad.go", `package foo
|
|
|
|
import "regexp"
|
|
|
|
func clean(s string) string {
|
|
re := regexp.MustCompile(`+"`"+`(?s)<script[^>]*>.*?</script>`+"`"+`)
|
|
return re.ReplaceAllString(s, "")
|
|
}
|
|
`)
|
|
vs := checkHTMLSanitize(dir)
|
|
if len(vs) == 0 {
|
|
t.Fatal("expected regex-html-strip violation for <script>")
|
|
}
|
|
}
|
|
|
|
func TestCheckHTMLSanitize_HandRolledFunc(t *testing.T) {
|
|
dir := t.TempDir()
|
|
writeFile(t, dir, "bad.go", `package foo
|
|
|
|
func stripHTML(s string) string {
|
|
return s
|
|
}
|
|
`)
|
|
vs := checkHTMLSanitize(dir)
|
|
if len(vs) == 0 {
|
|
t.Fatal("expected hand-rolled-strip-func violation")
|
|
}
|
|
if vs[0].rule != "hand-rolled-strip-func" {
|
|
t.Fatalf("expected rule hand-rolled-strip-func, got %s", vs[0].rule)
|
|
}
|
|
}
|
|
|
|
func TestCheckHTMLSanitize_CharByChar(t *testing.T) {
|
|
dir := t.TempDir()
|
|
writeFile(t, dir, "bad.go", `package foo
|
|
|
|
func strip(s string) string {
|
|
inTag := false
|
|
for _, r := range s {
|
|
if r == '<' {
|
|
inTag = true
|
|
}
|
|
}
|
|
_ = inTag
|
|
return s
|
|
}
|
|
`)
|
|
vs := checkHTMLSanitize(dir)
|
|
if len(vs) == 0 {
|
|
t.Fatal("expected char-by-char-tag-strip violation")
|
|
}
|
|
}
|
|
|
|
func TestCheckHTMLSanitize_BluemondayOK(t *testing.T) {
|
|
dir := t.TempDir()
|
|
writeFile(t, dir, "good.go", `package foo
|
|
|
|
import "github.com/microcosm-cc/bluemonday"
|
|
|
|
func clean(s string) string {
|
|
return bluemonday.StrictPolicy().Sanitize(s)
|
|
}
|
|
`)
|
|
vs := checkHTMLSanitize(dir)
|
|
if len(vs) != 0 {
|
|
t.Fatalf("expected no violations for bluemonday usage, got %d", len(vs))
|
|
}
|
|
}
|
|
|
|
func TestCheckHTMLSanitize_TestFilesAllowed(t *testing.T) {
|
|
dir := t.TempDir()
|
|
writeFile(t, dir, "strip_test.go", `package foo
|
|
|
|
func stripHTML(s string) string {
|
|
return s
|
|
}
|
|
`)
|
|
vs := checkHTMLSanitize(dir)
|
|
if len(vs) != 0 {
|
|
t.Fatalf("expected test files to be allowed, got %d violations", len(vs))
|
|
}
|
|
}
|
|
|
|
func writeFile(t *testing.T, dir, name, content string) {
|
|
t.Helper()
|
|
err := os.WriteFile(filepath.Join(dir, name), []byte(content), 0o644)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|