| 1 | package seedmark |
| 2 | |
| 3 | import ( |
| 4 | "crypto/sha256" |
| 5 | "encoding/json" |
| 6 | "fmt" |
| 7 | "os" |
| 8 | "strings" |
| 9 | "testing" |
| 10 | ) |
| 11 | |
| 12 | // TestVersionOneMatchesUpstreamSVG pins the v1 output from Seedmark commit |
| 13 | // c808a940bc193f97512c02d58da33ecc28ba1f53. Seedmark is MIT licensed; its |
| 14 | // Go port and upstream license are in this package. The fixture generator is |
| 15 | // scripts/qa/generate-seedmark-fixture.mjs. |
| 16 | func TestVersionOneMatchesUpstreamSVG(t *testing.T) { |
| 17 | raw, err := os.ReadFile("testdata/v1.json" ) |
| 18 | if err != nil { |
| 19 | t.Fatal(err) |
| 20 | } |
| 21 | var fixtures []struct{ Seed, Family, SHA256 string } |
| 22 | if err := json.Unmarshal(raw, &fixtures); err != nil { |
| 23 | t.Fatal(err) |
| 24 | } |
| 25 | families := map[string]bool{} |
| 26 | if len(fixtures) != 1010 { |
| 27 | t.Fatalf("fixtures contain %d cases, want 1010" , len(fixtures)) |
| 28 | } |
| 29 | for _, fixture := range fixtures { |
| 30 | families[fixture.Family] = true |
| 31 | digest := fmt.Sprintf("%x" , sha256.Sum256([]byte(Avatar(fixture.Seed)))) |
| 32 | if digest != fixture.SHA256 { |
| 33 | t.Fatalf("seed %q (%s): got SHA256 %s, want %s" , fixture.Seed, fixture.Family, digest, fixture.SHA256) |
| 34 | } |
| 35 | } |
| 36 | if len(families) != 8 { |
| 37 | t.Fatalf("fixtures cover %d families" , len(families)) |
| 38 | } |
| 39 | } |
| 40 | |
| 41 | func TestSeedNeverAppearsInMarkup(t *testing.T) { |
| 42 | for _, seed := range []string{`<script>alert(1)</script>` , `" onload="alert(1)` , "https://example.test/identity" } { |
| 43 | svg := Avatar(seed) |
| 44 | if strings.Contains(svg, seed) || strings.Contains(svg, "<script" ) || strings.Contains(svg, "onload" ) || strings.Contains(svg, "href=" ) || strings.Contains(svg, "class=" ) { |
| 45 | t.Fatalf("seed affected SVG markup: %s" , svg) |
| 46 | } |
| 47 | } |
| 48 | } |