Open History to see the last commit
1import { describe, expect, it } from "vite-plus/test";
2
3import {
4 decodeThirdPartyLicenseManifest,
5 thirdPartyLicenseEntryKey,
6 type ThirdPartyLicenseEntry,
7} from "./thirdPartyLicenses.js";
8
9const ENTRIES: ReadonlyArray<ThirdPartyLicenseEntry> = [
10 {
11 bundles: ["web"],
12 kind: "package",
13 license: "MIT",
14 name: "react",
15 noticeText: "React license",
16 sourceUrl: "https://react.dev",
17 version: "19.2.6",
18 },
19 {
20 bundles: ["assets", "mobile"],
21 kind: "custom",
22 license: "CC-BY-4.0",
23 name: "sample-icons",
24 noticeText: "Icon notice",
25 sourceUrl: null,
26 version: null,
27 },
28];
29
30describe("third-party license manifests", () => {
31 it("rejects unsafe source links", () => {
32 expect(() =>
33 decodeThirdPartyLicenseManifest({
34 schemaVersion: 1,
35 entries: [{ ...ENTRIES[0]!, sourceUrl: "javascript:alert(1)" }],
36 }),
37 ).toThrow("invalid shape");
38 });
39
40 it("uses distinct navigation keys when names and versions contain delimiters", () => {
41 const first = thirdPartyLicenseEntryKey({ ...ENTRIES[0]!, name: "a:1", version: null });
42 const second = thirdPartyLicenseEntryKey({ ...ENTRIES[0]!, name: "a", version: "1:custom" });
43
44 expect(first).not.toBe(second);
45 });
46});