/* +-------------------------------------------------------------------------+ | Copyright (C) 2004-2026 The Cacti Group | +-------------------------------------------------------------------------+ | Cacti: The Complete RRDtool-based Graphing Solution | +-------------------------------------------------------------------------+ */ 'use strict'; const assert = require('node:assert/strict'); const fs = require('node:fs'); const path = require('node:path'); const test = require('node:test'); const vm = require('node:vm'); const layoutSource = fs.readFileSync( path.join(__dirname, '..', '..', 'include', 'layout.js'), 'utf8' ); // Pull a single function's source out of layout.js by brace-matching, so the // helper can be exercised in isolation without a browser or the full bundle. function extractFunction(name) { const start = layoutSource.indexOf(`function ${name}(`); assert.notEqual(start, -1, `${name}() must exist in layout.js`); const bodyStart = layoutSource.indexOf('{', start); let depth = 0; for (let offset = bodyStart; offset < layoutSource.length; offset++) { if (layoutSource[offset] === '{') { depth++; } else if (layoutSource[offset] === '}') { depth--; if (depth === 0) { return layoutSource.slice(start, offset + 1); } } } throw new Error(`Unable to extract ${name}()`); } function load(name, context = {}) { return vm.runInNewContext(`${extractFunction(name)}\n${name};`, context); } test('escapeString neutralises the HTML metacharacters used for XSS', () => { const escapeString = load('escapeString'); assert.equal(escapeString('