fix: escape docx publish hints in workspace templates
This commit is contained in:
@@ -10,6 +10,7 @@ import {
|
||||
buildPublishConstraints,
|
||||
buildSandboxSessionConstraints,
|
||||
ensureUserPublishLayout,
|
||||
renderWorkspaceHints,
|
||||
isPathInsidePublishDir,
|
||||
migrateUserPublishDir,
|
||||
PUBLISH_ROOT_DIR,
|
||||
@@ -129,6 +130,17 @@ test('buildSandboxSessionConstraints documents shell and forbids public url brow
|
||||
assert.match(text, /\/public\//);
|
||||
});
|
||||
|
||||
test('renderWorkspaceHints includes docx download guidance for published pages', () => {
|
||||
const text = renderWorkspaceHints({
|
||||
slug: USER_ID,
|
||||
username: 'john',
|
||||
publishDir: `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}`,
|
||||
displayName: 'John',
|
||||
});
|
||||
assert.match(text, /docx-generate/);
|
||||
assert.match(text, /public\/\*\.docx/);
|
||||
});
|
||||
|
||||
test('isPathInsidePublishDir blocks escape', () => {
|
||||
const publishDir = `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}`;
|
||||
assert.equal(isPathInsidePublishDir(publishDir, `/var/h5/${PUBLISH_ROOT_DIR}/${USER_ID}/report.html`), true);
|
||||
|
||||
Reference in New Issue
Block a user