import { describe, expect, test } from "bun:test"; import { formatSignature, makeCommit, sanitizeIdent, signatureNow } from "./objects"; const decoder = new TextDecoder(); describe("sanitizeIdent", () => { test("strips angle brackets so a name cannot carry a second mailbox", () => { expect(sanitizeIdent("Mallory ")).toBe("Mallory ceo@corp.example"); }); test("collapses newlines and control characters onto one line", () => { expect(sanitizeIdent("Mallory\ngpgsig evil\r\n\u0000x")).toBe("Mallory gpgsig evil x"); }); test("trims leading and trailing crud like git does", () => { expect(sanitizeIdent(" .,Mallory;: ")).toBe("Mallory"); }); test("keeps ordinary unicode names", () => { expect(sanitizeIdent("Zoë O'Brien-Łukasz")).toBe("Zoë O'Brien-Łukasz"); }); }); describe("formatSignature", () => { test("never emits a forged mailbox or an extra header line", () => { const line = formatSignature({ name: "Mallory \nparent 0000000000000000000000000000000000000000", email: "mallory@x", timestamp: 1_700_000_000, timezone: "+0000", }); expect(line).toBe( "Mallory ceo@corp.example parent 0000000000000000000000000000000000000000 1700000000 +0000", ); expect(line.includes("\n")).toBe(false); expect(line.indexOf("<")).toBe(line.lastIndexOf("<")); }); test("falls back to a placeholder when the name sanitizes to nothing", () => { expect(formatSignature({ name: "<>", email: "a@b", timestamp: 1, timezone: "+0000" })).toBe( "unknown 1 +0000", ); }); test("strips brackets and whitespace from the email and normalizes bad timezones", () => { expect(formatSignature({ name: "A", email: "a@b> 1 +0000", ); }); test("signatureNow sanitizes up front", () => { const signature = signatureNow("Eve \n", "eve@example.com"); expect(signature.name).toBe("Eve x@y"); expect(signature.email).toBe("eve@example.com"); }); test("makeCommit header count is stable under hostile names", async () => { const commit = await makeCommit({ tree: "4b825dc642cb6eb9a060e54bf8d69288fbee4904", parents: [], author: { name: "Eve\nparent deadbeef", email: "e@x", timestamp: 1, timezone: "+0000" }, committer: { name: "Bot", email: "bot@x", timestamp: 1, timezone: "+0000" }, message: "msg", }); const header = decoder.decode(commit.content).split("\n\n")[0] ?? ""; expect(header.split("\n")).toHaveLength(3); }); });