Make English the repository working language (#5)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
1 parent
e80cde0ea6
commit
0eaaa54e25
136 files changed
+1515
-1352
No files matched your search
@@ -14,18 +14,18 @@ const CLEAN =
|
||||
'<path d="M4 4h16v16H4z" /></svg>';
|
||||
|
||||
describe("sanitizeSkillIcon", () => {
|
||||
it("干净的 SVG 放行(trim 后原样返回,供内联渲染继承 currentColor)", () => {
|
||||
it("a clean SVG passes (returned as-is after trim so inline rendering inherits currentColor)", () => {
|
||||
expect(sanitizeSkillIcon(CLEAN)).toBe(CLEAN);
|
||||
expect(sanitizeSkillIcon(`\n ${CLEAN}\n`)).toBe(CLEAN);
|
||||
});
|
||||
|
||||
it("缺失 / 空串 / 空白回退 null", () => {
|
||||
it("missing / empty string / whitespace falls back to null", () => {
|
||||
expect(sanitizeSkillIcon(undefined)).toBeNull();
|
||||
expect(sanitizeSkillIcon("")).toBeNull();
|
||||
expect(sanitizeSkillIcon(" ")).toBeNull();
|
||||
});
|
||||
|
||||
it("非 <svg> 根拒绝(含伪装成文本的任意 HTML)", () => {
|
||||
it("a non-<svg> root is rejected (including arbitrary HTML posing as text)", () => {
|
||||
expect(sanitizeSkillIcon("<div>not svg</div>")).toBeNull();
|
||||
expect(sanitizeSkillIcon("plain text")).toBeNull();
|
||||
expect(sanitizeSkillIcon(`<img src=x>${CLEAN}`)).toBeNull();
|
||||
@@ -33,23 +33,23 @@ describe("sanitizeSkillIcon", () => {
|
||||
expect(sanitizeSkillIcon('<svgfoo viewBox="0 0 24 24"></svgfoo>')).toBeNull();
|
||||
});
|
||||
|
||||
it("含 <script 拒绝(大小写不敏感)", () => {
|
||||
it("containing <script is rejected (case-insensitive)", () => {
|
||||
expect(sanitizeSkillIcon("<svg><script>alert(1)</script></svg>")).toBeNull();
|
||||
expect(sanitizeSkillIcon('<svg><SCRIPT href="x"/></svg>')).toBeNull();
|
||||
});
|
||||
|
||||
it("含事件属性(on*=)拒绝", () => {
|
||||
it("event attributes (on*=) are rejected", () => {
|
||||
expect(sanitizeSkillIcon('<svg onload="alert(1)"><path d="M0 0" /></svg>')).toBeNull();
|
||||
expect(sanitizeSkillIcon('<svg><path d="M0 0" onclick="x()" /></svg>')).toBeNull();
|
||||
expect(sanitizeSkillIcon('<svg><path d="M0 0" ONLOAD = "x()" /></svg>')).toBeNull();
|
||||
});
|
||||
|
||||
it("含 foreignObject / xlink:href 拒绝", () => {
|
||||
it("foreignObject / xlink:href are rejected", () => {
|
||||
expect(sanitizeSkillIcon("<svg><foreignObject><div>x</div></foreignObject></svg>")).toBeNull();
|
||||
expect(sanitizeSkillIcon('<svg><use xlink:href="#evil" /></svg>')).toBeNull();
|
||||
});
|
||||
|
||||
it("任何 href 属性拒绝(不限 xlink:,大小写不敏感,单双引号/无引号形态)", () => {
|
||||
it("any href attribute is rejected (not just xlink:, case-insensitive, single/double/unquoted forms)", () => {
|
||||
expect(
|
||||
sanitizeSkillIcon('<svg><a href="javascript:alert(1)"><path d="M0 0" /></a></svg>'),
|
||||
).toBeNull();
|
||||
@@ -59,7 +59,7 @@ describe("sanitizeSkillIcon", () => {
|
||||
expect(sanitizeSkillIcon('<svg><use HREF = "#evil" /></svg>')).toBeNull();
|
||||
});
|
||||
|
||||
it("路径数据里的坐标不误伤(stroke=none、d 属性带负数/小数照常放行)", () => {
|
||||
it("coordinates in path data are not false positives (stroke=none and d attributes with negatives/decimals still pass)", () => {
|
||||
const icon =
|
||||
'<svg viewBox="0 0 24 24"><path d="M2.5 3h6a4 4 0 0 1 4 4v14" fill="none" /></svg>';
|
||||
expect(sanitizeSkillIcon(icon)).toBe(icon);
|
||||
|
||||
Reference in new issue
Block a user