ffb9249ded
A mirrored playlist named with an apostrophe (e.g. "Road trip-The
Rolfe's") rendered dead action buttons. _escAttr HTML-escapes ' to ',
but it was used to inject the name into a single-quoted JS string inside an
inline onclick. The HTML parser decodes ' back to a bare ' BEFORE the JS
parser runs, producing an unterminated string literal -> SyntaxError -> the
whole handler fails to compile.
Two symptoms (both reproduced with the real name + the literal line-524
onclick template): clicking the X delete never ran event.stopPropagation(),
so the click bubbled to the card and opened the track preview instead; and
the preview's "Delete Mirror" silently did nothing (no DELETE request, no
log). Plain names ("Classic Rock") were unaffected, which is why it looked
intermittent.
Add a dedicated _escJs() that backslash-escapes the JS metacharacters (\, ')
first, then HTML-escapes the attribute-breaking chars - correct for a
single-quoted JS string inside a double-quoted HTML attribute. Convert all 16
inline-onclick string-argument sites to it: mirrored card (clear/Auto-Sync/
link/delete) and preview modal, plus the same latent bug in pool Fix Match /
Rematch, group bulk-toggle/rename/delete, and automation history/group/delete.
Genuine HTML-attribute usages (class/value/data-*/title/option) stay on
_escAttr where it is correct.
Tests: tests/static/test_stats_automations_esc.mjs extracts the real _escJs/
_escAttr from source and asserts apostrophe + quote/backslash/&/<> names
round-trip through HTML+JS decoding, documents that _escAttr throws a
SyntaxError for the apostrophe case while _escJs compiles clean, and pins
wolf39's exact name. pytest shim tests/test_stats_automations_esc_js.py runs
it under node --test (skips if node<22 / absent).
72 lines
2.2 KiB
Python
72 lines
2.2 KiB
Python
"""Run the JS escaping tests for `webui/static/stats-automations.js` under the
|
|
regular pytest sweep.
|
|
|
|
The actual contract tests live in `tests/static/test_stats_automations_esc.mjs`
|
|
and run via Node.js's stable built-in test runner (`node --test`). This shim
|
|
shells out to that runner and asserts a clean exit so the JS tests fail the
|
|
suite if the inline-onclick escaping (`_escJs`) regresses — e.g. a playlist or
|
|
automation named with an apostrophe silently breaking its action buttons.
|
|
|
|
Skipped when:
|
|
- `node` isn't on PATH (e.g. Python-only dev container).
|
|
- Node version < 22 (the assert-flavor used by the test is 22+).
|
|
|
|
Run directly:
|
|
node --test tests/static/test_stats_automations_esc.mjs
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import shutil
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
|
|
_REPO_ROOT = Path(__file__).resolve().parents[1]
|
|
_TEST_FILE = _REPO_ROOT / "tests" / "static" / "test_stats_automations_esc.mjs"
|
|
|
|
|
|
def _node_available() -> bool:
|
|
if not shutil.which("node"):
|
|
return False
|
|
try:
|
|
result = subprocess.run(
|
|
["node", "--version"],
|
|
capture_output=True, text=True, timeout=10,
|
|
)
|
|
except (subprocess.SubprocessError, FileNotFoundError):
|
|
return False
|
|
if result.returncode != 0:
|
|
return False
|
|
raw = (result.stdout or "").strip().lstrip("v")
|
|
try:
|
|
major = int(raw.split(".")[0])
|
|
except (ValueError, IndexError):
|
|
return False
|
|
return major >= 22
|
|
|
|
|
|
def test_stats_automations_esc_js():
|
|
"""Pin the inline-onclick escaping contract via `node --test`."""
|
|
if not _node_available():
|
|
pytest.skip("Node.js >= 22 required to run the JS escaping tests")
|
|
|
|
if not _TEST_FILE.exists():
|
|
pytest.skip(f"JS test file missing: {_TEST_FILE}")
|
|
|
|
result = subprocess.run(
|
|
["node", "--test", str(_TEST_FILE)],
|
|
capture_output=True, text=True,
|
|
cwd=str(_REPO_ROOT),
|
|
timeout=60,
|
|
)
|
|
|
|
if result.returncode != 0:
|
|
pytest.fail(
|
|
"JS stats-automations escaping tests failed:\n\n"
|
|
f"--- stdout ---\n{result.stdout}\n"
|
|
f"--- stderr ---\n{result.stderr}",
|
|
pytrace=False,
|
|
)
|