path: root/tpl/internal/go_templates/htmltemplate/js_test.go

// Copyright 2011 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build go1.13 && !windows
// +build go1.13,!windows

package template

import (
	"errors"
	"math"
	"strings"
	"testing"
)

func TestNextJsCtx(t *testing.T) {
	tests := []struct {
		jsCtx jsCtx
		s     string
	}{
		// Statement terminators precede regexps.
		{jsCtxRegexp, ";"},
		// This is not airtight.
		//     ({ valueOf: function () { return 1 } } / 2)
		// is valid JavaScript but in practice, devs do not do this.
		// A block followed by a statement starting with a RegExp is
		// much more common:
		//     while (x) {...} /foo/.test(x) || panic()
		{jsCtxRegexp, "}"},
		// But member, call, grouping, and array expression terminators
		// precede div ops.
		{jsCtxDivOp, ")"},
		{jsCtxDivOp, "]"},
		// At the start of a primary expression, array, or expression
		// statement, expect a regexp.
		{jsCtxRegexp, "("},
		{jsCtxRegexp, "["},
		{jsCtxRegexp, "{"},
		// Assignment operators precede regexps as do all exclusively
		// prefix and binary operators.
		{jsCtxRegexp, "="},
		{jsCtxRegexp, "+="},
		{jsCtxRegexp, "*="},
		{jsCtxRegexp, "*"},
		{jsCtxRegexp, "!"},
		// Whether the + or - is infix or prefix, it cannot precede a
		// div op.
		{jsCtxRegexp, "+"},
		{jsCtxRegexp, "-"},
		// An incr/decr op precedes a div operator.
		// This is not airtight. In (g = ++/h/i) a regexp follows a
		// pre-increment operator, but in practice devs do not try to
		// increment or decrement regular expressions.
		// (g++/h/i) where ++ is a postfix operator on g is much more
		// common.
		{jsCtxDivOp, "--"},
		{jsCtxDivOp, "++"},
		{jsCtxDivOp, "x--"},
		// When we have many dashes or pluses, then they are grouped
		// left to right.
		{jsCtxRegexp, "x---"}, // A postfix -- then a -.
		// return followed by a slash returns the regexp literal or the
		// slash starts a regexp literal in an expression statement that
		// is dead code.
		{jsCtxRegexp, "return"},
		{jsCtxRegexp, "return "},
		{jsCtxRegexp, "return\t"},
		{jsCtxRegexp, "return\n"},
		{jsCtxRegexp, "return\u2028"},
		// Identifiers can be divided and cannot validly be preceded by
		// a regular expressions. Semicolon insertion cannot happen
		// between an identifier and a regular expression on a new line
		// because the one token lookahead for semicolon insertion has
		// to conclude that it could be a div binary op and treat it as
		// such.
		{jsCtxDivOp, "x"},
		{jsCtxDivOp, "x "},
		{jsCtxDivOp, "x\t"},
		{jsCtxDivOp, "x\n"},
		{jsCtxDivOp, "x\u2028"},
		{jsCtxDivOp, "preturn"},
		// Numbers precede div ops.
		{jsCtxDivOp, "0"},
		// Dots that are part of a number are div preceders.
		{jsCtxDivOp, "0."},
		// Some JS interpreters treat NBSP as a normal space, so
		// we must too in order to properly escape things.
		{jsCtxRegexp, "=\u00A0"},
	}

	for _, test := range tests {
		if ctx := nextJSCtx([]byte(test.s), jsCtxRegexp); ctx != test.jsCtx {
			t.Errorf("%q: want %s got %s", test.s, test.jsCtx, ctx)
		}
		if ctx := nextJSCtx([]byte(test.s), jsCtxDivOp); ctx != test.jsCtx {
			t.Errorf("%q: want %s got %s", test.s, test.jsCtx, ctx)
		}
	}

	if nextJSCtx([]byte("   "), jsCtxRegexp) != jsCtxRegexp {
		t.Error("Blank tokens")
	}

	if nextJSCtx([]byte("   "), jsCtxDivOp) != jsCtxDivOp {
		t.Error("Blank tokens")
	}
}

type jsonErrType struct{}

func (e *jsonErrType) MarshalJSON() ([]byte, error) {
	return nil, errors.New("beep */ boop </script blip <!--")
}

func TestJSValEscaper(t *testing.T) {
	tests := []struct {
		x        any
		js       string
		skipNest bool
	}{
		{int(42), " 42 ", false},
		{uint(42), " 42 ", false},
		{int16(42), " 42 ", false},
		{uint16(42), " 42 ", false},
		{int32(-42), " -42 ", false},
		{uint32(42), " 42 ", false},
		{int16(-42), " -42 ", false},
		{uint16(42), " 42 ", false},
		{int64(-42), " -42 ", false},
		{uint64(42), " 42 ", false},
		{uint64(1) << 53, " 9007199254740992 ", false},
		// ulp(1 << 53) > 1 so this loses precision in JS
		// but it is still a representable integer literal.
		{uint64(1)<<53 + 1, " 9007199254740993 ", false},
		{float32(1.0), " 1 ", false},
		{float32(-1.0), " -1 ", false},
		{float32(0.5), " 0.5 ", false},
		{float32(-0.5), " -0.5 ", false},
		{float32(1.0) / float32(256), " 0.00390625 ", false},
		{float32(0), " 0 ", false},
		{math.Copysign(0, -1), " -0 ", false},
		{float64(1.0), " 1 ", false},
		{float64(-1.0), " -1 ", false},
		{float64(0.5), " 0.5 ", false},
		{float64(-0.5), " -0.5 ", false},
		{float64(0), " 0 ", false},
		{math.Copysign(0, -1), " -0 ", false},
		{"", `""`, false},
		{"foo", `"foo"`, false},
		// Newlines.
		{"\r\n\u2028\u2029", `"\r\n\u2028\u2029"`, false},
		// "\v" == "v" on IE 6 so use "\u000b" instead.
		{"\t\x0b", `"\t\u000b"`, false},
		{struct{ X, Y int }{1, 2}, `{"X":1,"Y":2}`, false},
		{[]any{}, "[]", false},
		{[]any{42, "foo", nil}, `[42,"foo",null]`, false},
		{[]string{"<!--", "</script>", "-->"}, `["\u003c!--","\u003c/script\u003e","--\u003e"]`, false},
		{"<!--", `"\u003c!--"`, false},
		{"-->", `"--\u003e"`, false},
		{"<![CDATA[", `"\u003c![CDATA["`, false},
		{"]]>", `"]]\u003e"`, false},
		{"</script", `"\u003c/script"`, false},
		{"\U0001D11E", "\"\U0001D11E\"", false}, // or "\uD834\uDD1E"
		{nil, " null ", false},
		{&jsonErrType{}, " /* json: error calling MarshalJSON for type *template.jsonErrType: beep * / boop \\x3C/script blip \\x3C!-- */null ", true},
	}

	for _,