@@ -16,15 +16,16 @@ function renderAssistantImage(url: string) {
1616}
17171818describe("chat image open safety", () => {
19-it("opens safe image URLs in a hardened new tab", async () => {
19+it("opens only safe image URLs in a hardened new tab", async () => {
2020const app = mountApp("/chat");
2121await app.updateComplete;
22222323const openSpy = vi.spyOn(window, "open").mockReturnValue(null);
24+2425app.chatMessages = [renderAssistantImage("https://example.com/cat.png")];
2526await app.updateComplete;
262727-const image = app.querySelector<HTMLImageElement>(".chat-message-image");
28+let image = app.querySelector<HTMLImageElement>(".chat-message-image");
2829expect(image).not.toBeNull();
2930image?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
3031@@ -34,34 +35,24 @@ describe("chat image open safety", () => {
3435"_blank",
3536"noopener,noreferrer",
3637);
37-});
38-39-it("does not open unsafe image URLs", async () => {
40-const app = mountApp("/chat");
41-await app.updateComplete;
423843-const openSpy = vi.spyOn(window, "open").mockReturnValue(null);
39+openSpy.mockClear();
4440app.chatMessages = [renderAssistantImage("javascript:alert(1)")];
4541await app.updateComplete;
464247-const image = app.querySelector<HTMLImageElement>(".chat-message-image");
43+image = app.querySelector<HTMLImageElement>(".chat-message-image");
4844expect(image).not.toBeNull();
4945image?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
50465147expect(openSpy).not.toHaveBeenCalled();
52-});
534854-it("does not open SVG data image URLs", async () => {
55-const app = mountApp("/chat");
56-await app.updateComplete;
57-58-const openSpy = vi.spyOn(window, "open").mockReturnValue(null);
49+openSpy.mockClear();
5950app.chatMessages = [
6051renderAssistantImage("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' />"),
6152];
6253await app.updateComplete;
635464-const image = app.querySelector<HTMLImageElement>(".chat-message-image");
55+image = app.querySelector<HTMLImageElement>(".chat-message-image");
6556expect(image).not.toBeNull();
6657image?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
6758此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。