George Lambert
b4150c8250
Compose-ready workspace: packages/zappier (rate card, portal, Stripe), packages/verae-zapier-middleware (timestamp + NATS), packages/verae-zapier (CLI app), vendor/zapier-platform, and research/zapier vendor corpus. Gate 0 structure checks pass. Product code and research are not yet wired.
59 lines
1.8 KiB
JavaScript
59 lines
1.8 KiB
JavaScript
const { renderTemplate } = require('../middleware-factory');
|
|
|
|
describe('middleware renderTemplate security', () => {
|
|
it('should handle normal template rendering', () => {
|
|
const context = { clientId: 'test123', secret: 'mysecret' };
|
|
const template = 'Client: {{clientId}}, Secret: {{secret}}';
|
|
|
|
const result = renderTemplate(template, context);
|
|
result.should.equal('Client: test123, Secret: mysecret');
|
|
});
|
|
|
|
it('should prevent code injection in middleware templates', () => {
|
|
const context = {
|
|
clientId: 'test123',
|
|
malicious: 'process.exit(1)',
|
|
};
|
|
|
|
// This should NOT execute the malicious code
|
|
const result = renderTemplate(
|
|
'ID: {{clientId}}, Value: {{malicious}}',
|
|
context,
|
|
);
|
|
result.should.equal('ID: test123, Value: process.exit(1)');
|
|
});
|
|
|
|
it('should handle non-string template input safely in middleware', () => {
|
|
const context = { test: 'value' };
|
|
|
|
(() => {
|
|
renderTemplate({}, context);
|
|
}).should.throw('Template string must be a primitive');
|
|
|
|
(() => {
|
|
renderTemplate([], context);
|
|
}).should.throw('Template string must be a primitive');
|
|
|
|
(() => {
|
|
renderTemplate(() => {
|
|
console.log('do evil stuff');
|
|
}, context);
|
|
}).should.throw('Template string must be a primitive');
|
|
});
|
|
|
|
it('should handle template errors gracefully in middleware', () => {
|
|
const context = { name: 'John' };
|
|
|
|
// Malformed template should return original string, not crash
|
|
const result = renderTemplate('{{unclosed', context);
|
|
result.should.equal('{{unclosed');
|
|
});
|
|
|
|
it('should handle undefined variables with defaults', () => {
|
|
const context = { name: 'John' };
|
|
|
|
// renderTemplate sets undefined vars to empty string
|
|
const result = renderTemplate('{{name}} {{undefined_var}}', context);
|
|
result.should.equal('John ');
|
|
});
|
|
});
|