47 lines
1.4 KiB
Go
47 lines
1.4 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"html/template"
|
|
"strings"
|
|
"testing"
|
|
|
|
"cmautobuy/admin/service"
|
|
)
|
|
|
|
func TestPddImportResultTemplate_完整集合和失败明细安全渲染(t *testing.T) {
|
|
tmpl, err := template.ParseFS(templateFS, "templates/*/*.html")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var output bytes.Buffer
|
|
data := map[string]any{
|
|
"Title": "PDD 商品", "Active": "pdd", "CSRFToken": "test-csrf",
|
|
"ImportResult": &service.PddImportResult{
|
|
TotalRows: 25, CreatedCount: 2, ExistingCount: 1, DuplicateCount: 1,
|
|
GoodsIDs: []string{"737116531267", "647453710994"},
|
|
Failures: []service.PddImportFailure{{
|
|
Row: 5, Raw: "<script>alert(1)</script>", Reason: "不是拼多多网址",
|
|
}},
|
|
},
|
|
}
|
|
if err := tmpl.ExecuteTemplate(&output, "pdd/list", data); err != nil {
|
|
t.Fatalf("渲染 PDD 导入结果失败: %v", err)
|
|
}
|
|
body := output.String()
|
|
for _, want := range []string{
|
|
"本次导入结果", "总行数 <strong>25</strong>",
|
|
`data-collect-form="pdd-import-collect-form"`,
|
|
`name="ids" value="737116531267"`,
|
|
`name="ids" value="647453710994"`,
|
|
"Excel 行号", "不是拼多多网址", "<script>alert(1)</script>",
|
|
} {
|
|
if !strings.Contains(body, want) {
|
|
t.Errorf("导入结果页面缺少 %q", want)
|
|
}
|
|
}
|
|
if strings.Contains(body, "<script>alert(1)</script>") {
|
|
t.Error("Excel 原始内容没有经过 html/template 自动转义")
|
|
}
|
|
}
|