fix: sanitize app status summary (#19075)

Fixes https://github.com/coder/coder/issues/18875
2026-09-24 15:04:27 +08:00 · 2025-07-29 15:24:11 +01:00
parent 29486f9d4e
commit 812d72c5bb
5 changed files with 86 additions and 3 deletions
@@ -3,6 +3,7 @@ package strings_test
 import (
 	"testing"

+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

 	"github.com/coder/coder/v2/coderd/util/strings"
@@ -37,3 +38,41 @@ func TestTruncate(t *testing.T) {
 		})
 	}
 }
+
+func TestUISanitize(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range []struct {
+		s        string
+		expected string
+	}{
+		{"normal text", "normal text"},
+		{"\tfoo \r\\nbar  ", "foo bar"},
+		{"通常のテキスト", "通常のテキスト"},
+		{"foo\nbar", "foo bar"},
+		{"foo\tbar", "foo bar"},
+		{"foo\rbar", "foo bar"},
+		{"foo\x00bar", "foobar"},
+		{"\u202Eabc", "abc"},
+		{"\u200Bzero width", "zero width"},
+		{"foo\x1b[31mred\x1b[0mbar", "fooredbar"},
+		{"foo\u0008bar", "foobar"},
+		{"foo\x07bar", "foobar"},
+		{"foo\uFEFFbar", "foobar"},
+		{"<a href='javascript:alert(1)'>link</a>", "link"},
+		{"<style>body{display:none}</style>", ""},
+		{"<html>HTML</html>", "HTML"},
+		{"<br>line break", "line break"},
+		{"<link rel='stylesheet' href='evil.css'>", ""},
+		{"<img src=1 onerror=alert(1)>", ""},
+		{"<!-- comment -->visible", "visible"},
+		{"<script>alert('xss')</script>", ""},
+		{"<iframe src='evil.com'></iframe>", ""},
+	} {
+		t.Run(tt.expected, func(t *testing.T) {
+			t.Parallel()
+			actual := strings.UISanitize(tt.s)
+			assert.Equal(t, tt.expected, actual)
+		})
+	}
+}