#!/usr/bin/env node
/**
* XSS Protection Verification
*/
const renderer = require('../scripts/lib/dashboard-renderer.cjs');
console.log('\nXSS Protection Verification');
console.log('='.repeat(70));
// Test 1: Image onerror payload
const xssPayload1 = '
';
const result1 = renderer.escapeHtml(xssPayload1);
console.log('\nTest 1: Image onerror');
console.log(`Input: ${xssPayload1}`);
console.log(`Output: ${result1}`);
const pass1 = !result1.includes('alert(1)',
status: 'pending',
progress: 0,
lastModified: '2025-12-11T10:00:00Z',
path: '"><"',
phases: { completed: 0, inProgress: 0, pending: 1, total: 1 }
}
];
const html = renderer.renderDashboard(plans, {
assetsDir: 'nonexistent' // Use fallback template
});
console.log('\nTest 3: Full dashboard render');
console.log(`Input: Malicious plan name and path`);
// Check that the HTML contains escaped version in plan card
// JSON will also contain escaped content but that's safe
const cardSectionStart = html.indexOf('');
const cardContent = cardSectionStart !== -1 ? html.substring(cardSectionStart, cardSectionEnd) : '';
const hasEscapedInCard = cardContent.includes('<script>');
const pass3 = hasEscapedInCard;
console.log(`Result: ${pass3 ? 'PASS' : 'FAIL'}`);
// Test 4: HTML structure
console.log('\nTest 4: HTML structure validity');
const hasDoctype = html.includes('');
const hasMain = html.includes('