Merge pull request #200 from contentstack/test/tags-as-text-in-jrte

test: add tests for html escaping in jsontohtml function

Author: nadeem-cs

__test__/json-to-html.test.ts

@@ -141,6 +141,129 @@ describe('Node parser paragraph content', () => {
         expect(entry.rich_text_editor).toEqual(escapeHtml)
         done()
     })
+
+    it('Should escape HTML tags in text content to prevent rendering as HTML', done => {
+        const entry = {
+            uid: 'test_uid',
+            rich_text_editor: {
+                uid: "uid",
+                _version: 1,
+                attrs: {},
+                children: [
+                    {
+                        children: [
+                            {
+                                text: '<b>Hello <i>world</i></b>! This is paragraph 1.'
+                            }
+                        ],
+                        type: 'p',
+                        uid: 'hjsbhys1234',
+                        attrs: {}
+                    }
+                ],
+                type: "doc"
+            }
+        }
+
+        jsonToHTML({entry, paths: ['rich_text_editor']})
+
+        expect(entry.rich_text_editor).toEqual('<p>&lt;b&gt;Hello &lt;i&gt;world&lt;/i&gt;&lt;/b&gt;! This is paragraph 1.</p>')
+        done()
+    })
+
+    it('Should escape HTML tags in text with actual bold formatting', done => {
+        const entry = {
+            uid: 'test_uid',
+            rich_text_editor: {
+                uid: "uid",
+                _version: 1,
+                attrs: {},
+                children: [
+                    {
+                        children: [
+                            {
+                                text: 'This is ',
+                            },
+                            {
+                                text: '<b>bold text</b>',
+                                bold: true
+                            },
+                            {
+                                text: ' with HTML tags'
+                            }
+                        ],
+                        type: 'p',
+                        uid: 'test_uid_1',
+                        attrs: {}
+                    }
+                ],
+                type: "doc"
+            }
+        }
+
+        jsonToHTML({entry, paths: ['rich_text_editor']})
+
+        expect(entry.rich_text_editor).toEqual('<p>This is <strong>&lt;b&gt;bold text&lt;/b&gt;</strong> with HTML tags</p>')
+        done()
+    })
+
+    it('Should escape dangerous script tags in text content', done => {
+        const entry = {
+            uid: 'test_uid',
+            rich_text_editor: {
+                uid: "uid",
+                _version: 1,
+                attrs: {},
+                children: [
+                    {
+                        children: [
+                            {
+                                text: '<script>alert("XSS")</script> This should be safe'
+                            }
+                        ],
+                        type: 'p',
+                        uid: 'test_uid_2',
+                        attrs: {}
+                    }
+                ],
+                type: "doc"
+            }
+        }
+
+        jsonToHTML({entry, paths: ['rich_text_editor']})
+
+        expect(entry.rich_text_editor).toEqual('<p>&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt; This should be safe</p>')
+        done()
+    })
+
+    it('Should escape HTML entities like ampersand and quotes in text', done => {
+        const entry = {
+            uid: 'test_uid',
+            rich_text_editor: {
+                uid: "uid",
+                _version: 1,
+                attrs: {},
+                children: [
+                    {
+                        children: [
+                            {
+                                text: 'Text with & ampersand and "quotes" should be escaped'
+                            }
+                        ],
+                        type: 'p',
+                        uid: 'test_uid_3',
+                        attrs: {}
+                    }
+                ],
+                type: "doc"
+            }
+        }
+
+        jsonToHTML({entry, paths: ['rich_text_editor']})
+
+        expect(entry.rich_text_editor).toEqual('<p>Text with &amp; ampersand and &quot;quotes&quot; should be escaped</p>')
+        done()
+    })
 })