Skip to content

Commit

Permalink
test: doT.process
Browse files Browse the repository at this point in the history
  • Loading branch information
epoberezkin committed Dec 7, 2019
1 parent fa3890d commit b4fd211
Showing 1 changed file with 51 additions and 23 deletions.
74 changes: 51 additions & 23 deletions test/process.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -2,30 +2,58 @@

var assert = require('assert');
var doT = require('..');
var fs = require('fs');


describe('doT.process', function() {
describe('polluting object prototype should not affect template compilation', function() {
it('should ignore varname on object prototype', function() {
var currentLog = console.log;
console.log = log;
var logged;

Object.prototype.templateSettings = {varname: 'it=(console.log("executed"),{})'};

try {
const templates = doT.process({path: './test'});
assert.notEqual(logged, 'executed');
// injected code can only be executed if undefined is passed to template function
templates.test();
assert.notEqual(logged, 'executed');
} finally {
console.log = currentLog;
}

function log(str) {
logged = str;
}
})
});
beforeEach(function() {
removeCompiledTemplateFiles();
});

afterEach(function() {
removeCompiledTemplateFiles();
});

function removeCompiledTemplateFiles() {
try { fs.unlinkSync('./test/templates/test.js'); } catch(e) {}
}

it('should compile all templates in folder', function() {
const templates = doT.process({path: './test/templates'});
var str = templates.test({data: 2});
assert.equal(str, '21');

var js = fs.statSync('./test/templates/test.js');
assert.ok(js.isFile());

// code below passes if the test is run without coverage using `npm run test-spec`
// because source code of doT.encodeHTMLSource is used inside compiled templates

// var fn = require('./templates/test.js');
// var str = fn({data: 2});
// assert.equal(str, '21');
});


it('should ignore varname with polluted object prototype', function() {
var currentLog = console.log;
console.log = log;
var logged;

Object.prototype.templateSettings = {varname: 'it=(console.log("executed"),{})'};

try {
const templates = doT.process({path: './test/templates'});
assert.notEqual(logged, 'executed');
// injected code can only be executed if undefined is passed to template function
templates.test();
assert.notEqual(logged, 'executed');
} finally {
console.log = currentLog;
}

function log(str) {
logged = str;
}
});
});

0 comments on commit b4fd211

Please sign in to comment.