test: Add test cases for various Svelte components handling unsafe HTML

tests/fixtures/common/ComplexExpression.expected.json

@@ -0,0 +1,43 @@
+{
+    "filename": "ComplexExpression.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": [
+        {
+            "filename": "ComplexExpression.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 6,
+                "column": 11
+            },
+            "end": {
+                "line": 6,
+                "column": 22
+            }
+        },
+        {
+            "filename": "ComplexExpression.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 7,
+                "column": 11
+            },
+            "end": {
+                "line": 7,
+                "column": 29
+            }
+        },
+        {
+            "filename": "ComplexExpression.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 8,
+                "column": 11
+            },
+            "end": {
+                "line": 8,
+                "column": 36
+            }
+        }
+    ]
+}

tests/fixtures/common/ComplexExpression.svelte

@@ -0,0 +1,9 @@
+<script>
+    let obj = { content: "<div>Test</div>" };
+</script>
+
+<div>
+    {@html obj.content}
+    {@html obj.content.trim()}
+    {@html obj.content.toUpperCase()}
+</div>

tests/fixtures/common/ComplexExpressionWithComment.expected.json

@@ -0,0 +1,19 @@
+{
+    "filename": "ComplexExpressionWithComment.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": [
+        {
+            "filename": "ComplexExpressionWithComment.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 10,
+                "column": 11
+            },
+            "end": {
+                "line": 10,
+                "column": 36
+            }
+        }
+    ]
+}

tests/fixtures/common/ComplexExpressionWithComment.svelte

@@ -0,0 +1,11 @@
+<script>
+    let obj = { content: "<div>Test</div>" };
+</script>
+
+<div>
+    <!-- svelte-ignore unsafe_html -->
+    {@html obj.content}
+    <!-- svelte-ignore unsafe_html -->
+    {@html obj.content.trim()}
+    {@html obj.content.toUpperCase()}
+</div>

tests/fixtures/common/OneUnsafeWithIgnoreComment.expected.json → tests/fixtures/common/Empty.expected.json

@@ -1,5 +1,5 @@
 {
-    "filename": "OneUnsafeWithIgnoreComment.svelte",
+    "filename": "Empty.svelte",
     "parsed": true,
     "error": null,
     "warnings": []

tests/fixtures/common/EmptyWithComment.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "EmptyWithComment.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/EmptyWithComment.svelte

@@ -0,0 +1 @@
+<!-- This is empty file with comment. -->

tests/fixtures/common/InComments.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "InComments.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/InComments.svelte

@@ -0,0 +1,8 @@
+<script>
+    // {@html commented}
+    /* {@html blocked} */
+    let x = 1;
+</script>
+
+<!-- {@html inHTMLComment} -->
+<div>Normal content</div>

tests/fixtures/common/InsideEach.expected.json

@@ -0,0 +1,19 @@
+{
+    "filename": "InsideEach.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": [
+        {
+            "filename": "InsideEach.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 10,
+                "column": 11
+            },
+            "end": {
+                "line": 10,
+                "column": 23
+            }
+        }
+    ]
+}

tests/fixtures/common/InsideEach.svelte

@@ -0,0 +1,11 @@
+<script>
+    let items = [
+        { content: '<strong>Item 1</strong>' },
+        { content: '<em>Item 2</em>' },
+        { content: '<u>Item 3</u>' }
+    ];
+</script>
+
+{#each items as item}
+    {@html item.content}
+{/each}

tests/fixtures/common/InsideEachWithComment.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "InsideEachWithComment.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/InsideEachWithComment.svelte

@@ -0,0 +1,12 @@
+<script>
+    let items = [
+        { content: '<strong>Item 1</strong>' },
+        { content: '<em>Item 2</em>' },
+        { content: '<u>Item 3</u>' }
+    ];
+</script>
+
+{#each items as item}
+    <!-- svelte-ignore unsafe_html -->
+    {@html item.content}
+{/each}

tests/fixtures/common/InsideIf.expected.json

@@ -0,0 +1,19 @@
+{
+    "filename": "InsideIf.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": [
+        {
+            "filename": "InsideIf.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 7,
+                "column": 15
+            },
+            "end": {
+                "line": 7,
+                "column": 39
+            }
+        }
+    ]
+}

tests/fixtures/common/InsideIf.svelte

@@ -0,0 +1,9 @@
+<script>
+    const insideIf = true;
+</script>
+
+<div>
+    {#if insideIf}
+        {@html "<span>Inside If</span>"}
+    {/if}
+</div>

tests/fixtures/common/InsideIfWithComment.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "InsideIfWithComment.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/InsideIfWithComment.svelte

@@ -0,0 +1,10 @@
+<script>
+    const insideIf = true;
+</script>
+
+<div>
+    {#if insideIf}
+        <!-- svelte-ignore unsafe_html -->
+        {@html "<span>Inside If</span>"}
+    {/if}
+</div>

tests/fixtures/common/MalformedHTML.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "MalformedHTML.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/MalformedHTML.svelte

@@ -0,0 +1 @@
+<div><span><b>oops</div>

tests/fixtures/common/Multiline.expected.json

@@ -0,0 +1,19 @@
+{
+    "filename": "Multiline.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": [
+        {
+            "filename": "Multiline.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 3,
+                "column": 8
+            },
+            "end": {
+                "line": 3,
+                "column": 34
+            }
+        }
+    ]
+}

tests/fixtures/common/Multiline.svelte

@@ -0,0 +1,5 @@
+<div>
+    {@html 
+        "<p>This is line one.</p>"
+    }
+</div>

tests/fixtures/common/MultilineWithComment.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "MultilineWithComment.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/MultilineWithComment.svelte

@@ -0,0 +1,6 @@
+<div>
+    <!-- svelte-ignore unsafe_html -->
+    {@html 
+        "<p>This is line one.</p>"
+    }
+</div>

tests/fixtures/common/NoIssues.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "NoIssues.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/NoIssues.svelte

@@ -0,0 +1,8 @@
+<script>
+    let text = "Safe text";
+</script>
+
+<div>
+    {text}
+    <p>No @html here</p>
+</div>

tests/fixtures/common/NoIssuesWithComment.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "NoIssuesWithComment.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/NoIssuesWithComment.svelte

@@ -0,0 +1,9 @@
+<script>
+    let text = "Safe text";
+</script>
+
+<div>
+    {text}
+    <!-- svelte-ignore unsafe_html -->
+    <p>No @html here</p>
+</div>

tests/fixtures/common/OneUnsafeWithComment.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "OneUnsafeWithComment.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/RTLInsideHTML.expected.json

@@ -0,0 +1,19 @@
+{
+    "filename": "RTLInsideHTML.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": [
+        {
+            "filename": "RTLInsideHTML.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 1,
+                "column": 7
+            },
+            "end": {
+                "line": 1,
+                "column": 26
+            }
+        }
+    ]
+}

tests/fixtures/common/RTLInsideHTML.svelte

@@ -0,0 +1 @@
+{@html "<p>שלום مرحبا</p>"}

tests/fixtures/common/RTLNormalText.expected.json

@@ -0,0 +1,6 @@
+{
+    "filename": "RTLNormalText.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": []
+}

tests/fixtures/common/RTLNormalText.svelte

@@ -0,0 +1 @@
+<p>שלום مرحبا</p>

tests/fixtures/common/TwoUnsafeWithScript.expected.json

@@ -0,0 +1,31 @@
+{
+    "filename": "TwoUnsafeWithScript.svelte",
+    "parsed": true,
+    "error": null,
+    "warnings": [
+        {
+            "filename": "TwoUnsafeWithScript.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 5,
+                "column": 10
+            },
+            "end": {
+                "line": 5,
+                "column": 28
+            }
+        },
+        {
+            "filename": "TwoUnsafeWithScript.svelte",
+            "message": "Unsafe raw HTML insertion without sanitizer",
+            "start": {
+                "line": 8,
+                "column": 10
+            },
+            "end": {
+                "line": 8,
+                "column": 48
+            }
+        }
+    ]
+}