auth-yes/src/tests/arch/xss_fuzzing.test.tsx

import { assertNotEquals, assertStringIncludes } from "jsr:@std/assert@1";
import { EventCockpitDeckFragment } from "../../features/events/fragments.tsx";
import { SessionTableFragment } from "../../features/sessions/fragments.tsx";
import { AdminUsersPageFragment } from "../../features/admin/fragments.tsx";

Deno.test("[Arch] XSS Fuzzing: EventCockpitDeckFragment escapes malicious event names and payloads", () => {
  const xssPayload =
    '<script>alert("xss")</script><img src=x onerror=alert(1)>';
  const mockEvents = [
    {
      id: "event-1",
      name: xssPayload,
      slug: "xss-test",
      pin_code: "123-456",
      seats_claimed: 5,
      max_seats: 50,
      expires_at: new Date().toISOString(),
    },
  ];

  const html = String(<EventCockpitDeckFragment eventPasses={mockEvents} />);

  // Assert raw script tag is NOT rendered
  assertNotEquals(html.includes('<script>alert("xss")</script>'), true);
  // Assert escaped HTML entity is present
  assertStringIncludes(html, "&lt;script&gt;");
});

Deno.test("[Arch] XSS Fuzzing: SessionTableFragment escapes malicious session labels", () => {
  const xssLabel = '"><script>alert(document.cookie)</script>';
  const mockSessions = [
    {
      id: "sess-xss",
      label: xssLabel,
      is_agent: true,
      custom_scopes: ["read:events"],
      created_at: new Date().toISOString(),
      expires_at: new Date().toISOString(),
    },
  ];

  const html = String(
    <SessionTableFragment
      sessions={mockSessions}
      currentSessionId="sess-xyz"
    />,
  );

  assertNotEquals(
    html.includes('"><script>alert(document.cookie)</script>'),
    true,
  );
  assertStringIncludes(html, "&lt;script&gt;");
});

Deno.test("[Arch] XSS Fuzzing: AdminUsersPageFragment escapes malicious usernames and emails", () => {
  const xssUsername = '<img src=x onerror=fetch("evil.com")>';
  const mockUsers = [
    {
      id: "user-1",
      username: xssUsername,
      role: "viewer",
      created_at: new Date().toISOString(),
    },
  ];

  const html = String(
    <AdminUsersPageFragment users={mockUsers} />,
  );

  assertNotEquals(
    html.includes('<img src=x onerror=fetch("evil.com")>'),
    true,
  );
  assertStringIncludes(html, "&lt;img");
});