@easyflow/javascript-sdk 2.1.7 → 2.1.9

package/libs/sanitizer.spec.js

@@ -1,583 +0,0 @@
-import { jest } from '@jest/globals'
-import { Sanitizer, sanitizeOrderData } from './sanitizer.mjs'
-
-// Mock deepClone
-jest.mock('./utils.mjs', () => ({
-    deepClone: jest.fn((data) => JSON.parse(JSON.stringify(data))),
-}))
-
-describe('Sanitizer', () => {
-    describe('sanitizeHeaders', () => {
-        test('should remove dangerous headers', () => {
-            const headers = {
-                'Content-Type': 'application/json',
-                'x-forwarded-for': 'malicious-ip',
-                Authorization: 'Bearer token',
-                'x-real-ip': 'another-malicious-ip',
-            }
-
-            const result = Sanitizer.sanitizeHeaders(headers)
-
-            expect(result).toEqual({
-                'Content-Type': 'application/json',
-                Authorization: 'Bearer token',
-            })
-            expect(result['x-forwarded-for']).toBeUndefined()
-            expect(result['x-real-ip']).toBeUndefined()
-        })
-
-        test('should handle case-insensitive header names', () => {
-            const headers = {
-                'X-Forwarded-For': 'malicious-ip',
-                'X-REAL-IP': 'another-malicious-ip',
-                'Content-Type': 'application/json',
-            }
-
-            const result = Sanitizer.sanitizeHeaders(headers)
-
-            expect(result).toEqual({
-                'Content-Type': 'application/json',
-            })
-        })
-
-        test('should return empty object for empty headers', () => {
-            const result = Sanitizer.sanitizeHeaders({})
-            expect(result).toEqual({})
-        })
-
-        test('should handle undefined headers', () => {
-            const result = Sanitizer.sanitizeHeaders(undefined)
-            expect(result).toEqual({})
-        })
-
-        test('should preserve safe headers', () => {
-            const headers = {
-                'Content-Type': 'application/json',
-                Authorization: 'Bearer token',
-                'User-Agent': 'Mozilla/5.0',
-                Accept: 'application/json',
-            }
-
-            const result = Sanitizer.sanitizeHeaders(headers)
-
-            expect(result).toEqual(headers)
-        })
-    })
-
-    describe('sanitizeInput', () => {
-        test('should sanitize string with dangerous characters', () => {
-            const input = '<script>alert("xss")</script>'
-            const result = Sanitizer.sanitizeInput(input)
-            expect(result).toBe('scriptalert("xss")/script')
-        })
-
-        test('should remove javascript: protocol', () => {
-            const input = 'javascript:alert("xss")'
-            const result = Sanitizer.sanitizeInput(input)
-            expect(result).toBe('alert("xss")')
-        })
-
-        test('should remove data: protocol', () => {
-            const input = 'data:text/html,<script>alert("xss")</script>'
-            const result = Sanitizer.sanitizeInput(input)
-            expect(result).toBe('text/html,scriptalert("xss")/script')
-        })
-
-        test('should remove vbscript: protocol', () => {
-            const input = 'vbscript:msgbox("xss")'
-            const result = Sanitizer.sanitizeInput(input)
-            expect(result).toBe('msgbox("xss")')
-        })
-
-        test('should trim whitespace', () => {
-            const input = '  test value  '
-            const result = Sanitizer.sanitizeInput(input)
-
-            expect(result).toBe('test value')
-        })
-
-        test('should return non-string values unchanged', () => {
-            expect(Sanitizer.sanitizeInput(123)).toBe(123)
-            expect(Sanitizer.sanitizeInput(true)).toBe(true)
-            expect(Sanitizer.sanitizeInput(null)).toBe(null)
-            expect(Sanitizer.sanitizeInput(undefined)).toBe(undefined)
-            expect(Sanitizer.sanitizeInput({})).toEqual({})
-            expect(Sanitizer.sanitizeInput([])).toEqual([])
-        })
-
-        test('should handle empty string', () => {
-            const result = Sanitizer.sanitizeInput('')
-            expect(result).toBe('')
-        })
-
-        test('should handle string with only dangerous characters', () => {
-            const input = '<>"\'&'
-            const result = Sanitizer.sanitizeInput(input)
-            expect(result).toBe('"\'')
-        })
-    })
-
-    describe('sanitizeCreditCard', () => {
-        test('should sanitize all credit card fields', () => {
-            const creditCard = {
-                cardNumber: '4111 1111 1111 1111',
-                cvv: '123',
-                month: '12',
-                year: '2025',
-                holderName: 'John Doe',
-            }
-
-            const result = Sanitizer.sanitizeCreditCard(creditCard)
-
-            expect(result).toEqual({
-                cardNumber: '4111 1111 1111 1111',
-                cvv: '123',
-                month: '12',
-                year: '2025',
-                holderName: 'John Doe',
-            })
-        })
-
-        test('should sanitize credit card with dangerous characters', () => {
-            const creditCard = {
-                cardNumber: '4111<script>1111</script>1111',
-                cvv: '123',
-                month: '12',
-                year: '2025',
-                holderName: '<script>alert("xss")</script>John Doe',
-            }
-
-            const result = Sanitizer.sanitizeCreditCard(creditCard)
-
-            expect(result).toEqual({
-                cardNumber: '4111script1111/script1111',
-                cvv: '123',
-                month: '12',
-                year: '2025',
-                holderName: 'scriptalert("xss")/scriptJohn Doe',
-            })
-        })
-
-        test('should handle missing fields', () => {
-            const creditCard = {
-                cardNumber: '4111111111111111',
-            }
-
-            const result = Sanitizer.sanitizeCreditCard(creditCard)
-
-            expect(result).toEqual({
-                cardNumber: '4111111111111111',
-                cvv: undefined,
-                month: undefined,
-                year: undefined,
-                holderName: undefined,
-            })
-        })
-    })
-})
-
-describe('sanitizeOrderData', () => {
-    test('should sanitize buyer information', () => {
-        const order = {
-            buyer: {
-                name: '<script>alert("xss")</script>John Doe',
-                email: 'john@example.com',
-                document: {
-                    number: '123<script>456</script>789',
-                    type: 'CPF',
-                },
-                phone: {
-                    number: '119999<script>99999</script>',
-                    areaCode: '11',
-                },
-                address: {
-                    zipCode: '01234<script>567</script>',
-                    street: 'Main Street',
-                    complement: 'Apt 123',
-                    neighborhood: 'Downtown',
-                    city: 'São Paulo',
-                    state: 'SP',
-                    number: '123',
-                },
-            },
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.buyer.name).toBe('scriptalert("xss")/scriptJohn Doe')
-        expect(result.buyer.email).toBe('john@example.com')
-        expect(result.buyer.document.number).toBe('123script456/script789')
-        expect(result.buyer.document.type).toBe('CPF')
-        expect(result.buyer.phone.number).toBe('119999script99999/script')
-        expect(result.buyer.phone.areaCode).toBe('11')
-        expect(result.buyer.address.zipCode).toBe('01234script567/script')
-        expect(result.buyer.address.street).toBe('Main Street')
-        expect(result.buyer.address.complement).toBe('Apt 123')
-        expect(result.buyer.address.neighborhood).toBe('Downtown')
-        expect(result.buyer.address.city).toBe('São Paulo')
-        expect(result.buyer.address.state).toBe('SP')
-        expect(result.buyer.address.number).toBe('123')
-    })
-
-    test('should sanitize delivery address', () => {
-        const order = {
-            buyer: {
-                deliveryAddress: {
-                    zipCode: '01234<script>567</script>',
-                    street: 'Delivery Street',
-                    complement: 'Apt 456',
-                    neighborhood: 'Uptown',
-                    city: 'Rio de Janeiro',
-                    state: 'RJ',
-                    number: '456',
-                },
-            },
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.buyer.deliveryAddress.zipCode).toBe(
-            '01234script567/script'
-        )
-        expect(result.buyer.deliveryAddress.street).toBe('Delivery Street')
-        expect(result.buyer.deliveryAddress.complement).toBe('Apt 456')
-        expect(result.buyer.deliveryAddress.neighborhood).toBe('Uptown')
-        expect(result.buyer.deliveryAddress.city).toBe('Rio de Janeiro')
-        expect(result.buyer.deliveryAddress.state).toBe('RJ')
-        expect(result.buyer.deliveryAddress.number).toBe('456')
-    })
-
-    test('should sanitize credit card payments', () => {
-        const order = {
-            payments: [
-                {
-                    method: 'credit-card',
-                    creditCard: {
-                        cardNumber: '4111<script>1111</script>1111',
-                        cvv: '123',
-                        month: '12',
-                        year: '2025',
-                        holderName: '<script>alert("xss")</script>John Doe',
-                    },
-                },
-            ],
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.payments[0].creditCard.cardNumber).toBe(
-            '4111script1111/script1111'
-        )
-        expect(result.payments[0].creditCard.cvv).toBe('123')
-        expect(result.payments[0].creditCard.month).toBe('12')
-        expect(result.payments[0].creditCard.year).toBe('2025')
-        expect(result.payments[0].creditCard.holderName).toBe(
-            'scriptalert("xss")/scriptJohn Doe'
-        )
-    })
-
-    test('should sanitize order items', () => {
-        const order = {
-            items: [
-                {
-                    externalReferenceId: 'ref<script>123</script>',
-                    description: 'Product<script>description</script>',
-                    name: 'Product<script>Name</script>',
-                    quantity: 1,
-                    priceInCents: 1000,
-                },
-            ],
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.items[0].externalReferenceId).toBe('refscript123/script')
-        expect(result.items[0].description).toBe(
-            'Productscriptdescription/script'
-        )
-        expect(result.items[0].name).toBe('ProductscriptName/script')
-        expect(result.items[0].quantity).toBe(1)
-        expect(result.items[0].priceInCents).toBe(1000)
-    })
-
-    test('should sanitize metadata', () => {
-        const order = {
-            metadata: [
-                {
-                    key: 'custom<script>key</script>',
-                    value: 'custom<script>value</script>',
-                },
-            ],
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.metadata[0].key).toBe('customscriptkey/script')
-        expect(result.metadata[0].value).toBe('customscriptvalue/script')
-    })
-
-    test('should handle order without buyer information', () => {
-        const order = {
-            payments: [{ method: 'pix' }],
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.buyer).toBeUndefined()
-        expect(result.payments).toEqual([{ method: 'pix' }])
-    })
-
-    test('should handle order without payments', () => {
-        const order = {
-            buyer: { name: 'John Doe' },
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.buyer.name).toBe('John Doe')
-        expect(result.payments).toBeUndefined()
-    })
-
-    test('should handle order without items', () => {
-        const order = {
-            buyer: { name: 'John Doe' },
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.buyer.name).toBe('John Doe')
-        expect(result.items).toBeUndefined()
-    })
-
-    test('should handle order without metadata', () => {
-        const order = {
-            buyer: { name: 'John Doe' },
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result.buyer.name).toBe('John Doe')
-        expect(result.metadata).toBeUndefined()
-    })
-
-    test('should return deep clone of original order', () => {
-        const order = {
-            buyer: { name: 'John Doe' },
-            payments: [{ method: 'pix' }],
-        }
-
-        const result = sanitizeOrderData(order)
-
-        expect(result).not.toBe(order)
-        expect(result.buyer).not.toBe(order.buyer)
-        expect(result.payments).not.toBe(order.payments)
-    })
-})
-
-describe('sanitizeObjectFields', () => {
-    test('should sanitize simple object with string fields', () => {
-        const obj = {
-            name: '<script>alert("xss")</script>',
-            email: 'user@example.com',
-            age: 25,
-            active: true,
-        }
-
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        expect(result.name).toBe('scriptalert("xss")/script')
-        expect(result.email).toBe('user@example.com')
-        expect(result.age).toBe(25)
-        expect(result.active).toBe(true)
-    })
-
-    test('should sanitize nested objects recursively', () => {
-        const obj = {
-            user: {
-                name: '<script>malicious</script>',
-                profile: {
-                    bio: 'Bio with <strong>HTML</strong>',
-                    website: 'javascript:alert("xss")',
-                },
-            },
-            settings: {
-                theme: 'dark',
-                notifications: true,
-            },
-        }
-
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        expect(result.user.name).toBe('scriptmalicious/script')
-        expect(result.user.profile.bio).toBe('Bio with strongHTML/strong')
-        expect(result.user.profile.website).toBe('alert("xss")')
-        expect(result.settings.theme).toBe('dark')
-        expect(result.settings.notifications).toBe(true)
-    })
-
-    test('should sanitize arrays of objects', () => {
-        const obj = {
-            users: [
-                {
-                    name: '<script>user1</script>',
-                    email: 'user1@example.com',
-                },
-                {
-                    name: '<script>user2</script>',
-                    email: 'user2@example.com',
-                },
-            ],
-            tags: ['tag1', '<script>malicious</script>', 'tag3'],
-        }
-
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        expect(result.users[0].name).toBe('scriptuser1/script')
-        expect(result.users[0].email).toBe('user1@example.com')
-        expect(result.users[1].name).toBe('scriptuser2/script')
-        expect(result.users[1].email).toBe('user2@example.com')
-        expect(result.tags[0]).toBe('tag1')
-        expect(result.tags[1]).toBe('scriptmalicious/script')
-        expect(result.tags[2]).toBe('tag3')
-    })
-
-    test('should handle primitive values correctly', () => {
-        const obj = {
-            string: '<script>test</script>',
-            number: 42,
-            boolean: false,
-            nullValue: null,
-            undefinedValue: undefined,
-        }
-
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        expect(result.string).toBe('scripttest/script')
-        expect(result.number).toBe(42)
-        expect(result.boolean).toBe(false)
-        expect(result.nullValue).toBe(null)
-        expect(result.undefinedValue).toBe(undefined)
-    })
-
-    test('should handle empty objects and arrays', () => {
-        const obj = {
-            emptyObj: {},
-            emptyArray: [],
-            nestedEmpty: {
-                empty: {},
-                array: [],
-            },
-        }
-
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        expect(result.emptyObj).toEqual({})
-        expect(result.emptyArray).toEqual([])
-        expect(result.nestedEmpty.empty).toEqual({})
-        expect(result.nestedEmpty.array).toEqual([])
-    })
-
-    test('should handle null and undefined input', () => {
-        expect(Sanitizer.sanitizeObjectFields(null)).toBe(null)
-        expect(Sanitizer.sanitizeObjectFields(undefined)).toBe(undefined)
-    })
-
-    test('should handle non-object inputs', () => {
-        expect(
-            Sanitizer.sanitizeObjectFields('test<script>string</script>')
-        ).toBe('testscriptstring/script')
-        expect(Sanitizer.sanitizeObjectFields(123)).toBe(123)
-        expect(Sanitizer.sanitizeObjectFields(true)).toBe(true)
-        expect(Sanitizer.sanitizeObjectFields('')).toBe('')
-    })
-
-    test('should preserve object structure', () => {
-        const obj = {
-            level1: {
-                level2: {
-                    level3: {
-                        value: '<script>deep</script>',
-                    },
-                },
-            },
-            array: [
-                {
-                    nested: {
-                        value: '<script>nested</script>',
-                    },
-                },
-            ],
-        }
-
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        // Verify structure is preserved
-        expect(result.level1).toBeDefined()
-        expect(result.level1.level2).toBeDefined()
-        expect(result.level1.level2.level3).toBeDefined()
-        expect(result.array).toBeDefined()
-        expect(result.array[0]).toBeDefined()
-        expect(result.array[0].nested).toBeDefined()
-
-        // Verify values are sanitized
-        expect(result.level1.level2.level3.value).toBe('scriptdeep/script')
-        expect(result.array[0].nested.value).toBe('scriptnested/script')
-    })
-
-    test('should handle circular references gracefully', () => {
-        const obj = { name: '<script>test</script>' }
-        obj.self = obj
-
-        // This should not cause infinite recursion
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        expect(result.name).toBe('scripttest/script')
-        expect(result.self).toBeDefined()
-    })
-
-    test('should sanitize complex nested structures', () => {
-        const obj = {
-            company: {
-                name: 'Company<script>Name</script>',
-                departments: [
-                    {
-                        name: 'IT<script>Dept</script>',
-                        employees: [
-                            {
-                                name: 'John<script>Doe</script>',
-                                skills: [
-                                    'JavaScript',
-                                    '<script>malicious</script>',
-                                    'React',
-                                ],
-                            },
-                        ],
-                    },
-                ],
-                settings: {
-                    theme: 'light<script>theme</script>',
-                    features: {
-                        enabled: true,
-                        name: 'Feature<script>Name</script>',
-                    },
-                },
-            },
-        }
-
-        const result = Sanitizer.sanitizeObjectFields(obj)
-
-        // Verify complex structure is sanitized
-        expect(result.company.name).toBe('CompanyscriptName/script')
-        expect(result.company.departments[0].name).toBe('ITscriptDept/script')
-        expect(result.company.departments[0].employees[0].name).toBe(
-            'JohnscriptDoe/script'
-        )
-        expect(result.company.departments[0].employees[0].skills[1]).toBe(
-            'scriptmalicious/script'
-        )
-        expect(result.company.settings.theme).toBe('lightscripttheme/script')
-        expect(result.company.settings.features.name).toBe(
-            'FeaturescriptName/script'
-        )
-    })
-})