memind/mindspace-content-scan.test.mjs

import assert from 'node:assert/strict';
import test from 'node:test';
import { redactContent, scanContent } from './mindspace-content-scan.mjs';

test('scanContent warns on phone numbers', () => {
  const result = scanContent('联系电话 13800138000');
  assert.equal(result.status, 'warned');
  assert.equal(result.allowed, true);
  assert.equal(result.findings[0].type, 'phone');
});

test('scanContent ignores trusted google font hosts', () => {
  const result = scanContent(
    "@import url('https://fonts.googleapis.com/css2?family=Noto+Sans+SC&display=swap');",
  );
  assert.equal(result.findings.length, 0);
  assert.equal(result.allowed, true);
});

test('scanContent blocks id cards', () => {
  const result = scanContent('身份证 11010119900307888X');
  assert.equal(result.status, 'blocked');
  assert.equal(result.allowed, false);
});

test('scanContent blocks html active content and private references', () => {
  const result = scanContent(
    '<script>alert(1)</script><a href="javascript:alert(1)">x</a><img src="/api/mindspace/v1/assets/abc/preview">',
    { format: 'html' },
  );
  assert.equal(result.allowed, false);
  assert.deepEqual(
    result.findings.map((finding) => finding.type),
    ['html_script', 'html_javascript_url', 'private_resource_reference'],
  );
});

test('scanContent can allow active html as acknowledgeable publication warnings', () => {
  const result = scanContent(
    '<button onclick="restartGame()">重新开始</button><script>requestAnimationFrame(loop)</script>',
    { format: 'html', allowHtmlActiveContent: true },
  );
  assert.equal(result.status, 'warned');
  assert.equal(result.allowed, true);
  assert.deepEqual(
    result.findings.map((finding) => [finding.type, finding.blocking]),
    [
      ['html_script', false],
      ['html_inline_handler', false],
    ],
  );
});

test('scanContent can allow interactive html forms as acknowledgeable warnings', () => {
  const result = scanContent(
    '<form id="survey"><input name="q1"></form><script src="/assets/page-data-client.js"></script>',
    { format: 'html', allowHtmlActiveContent: true },
  );
  assert.equal(result.status, 'warned');
  assert.equal(result.allowed, true);
  assert.deepEqual(
    result.findings.map((finding) => [finding.type, finding.blocking]),
    [
      ['html_script', false],
      ['html_form_action', false],
    ],
  );
});

test('scanContent blocks unresolved external script src even when html active content is allowed', () => {
  const result = scanContent(
    '<script src="https://cdn.example.com/app.js"></script><script>init()</script>',
    { format: 'html', allowHtmlActiveContent: true },
  );
  assert.equal(result.allowed, false);
  assert.ok(result.findings.some((finding) => finding.type === 'html_external_script' && finding.blocking));
});

test('scanContent allows same-origin script src with active html content', () => {
  const result = scanContent(
    '<script src="/assets/page-data-client.js"></script><script>init()</script>',
    { format: 'html', allowHtmlActiveContent: true },
  );
  assert.equal(result.allowed, true);
  assert.ok(!result.findings.some((finding) => finding.type === 'html_external_script'));
});

test('redactContent masks secrets and strips unsafe html', () => {
  const result = redactContent(
    '手机号 13800138000\n邮箱 john@example.com\n<script>alert(1)</script>\nkey=sk_test_1234567890abcdef',
    { format: 'html' },
  );
  assert.equal(result.changed, true);
  assert.doesNotMatch(result.content, /13800138000/);
  assert.doesNotMatch(result.content, /john@example.com/);
  assert.doesNotMatch(result.content, /<script>/);
  assert.doesNotMatch(result.content, /sk_test_1234567890abcdef/);
});