mirror of
https://github.com/hanzoai/gui.git
synced 2026-10-25 02:31:41 +00:00
zeekayandHanzo Dev
69c6e860d7
This repo could never sync. There was NO merge-base with tamagui — 372 commits
here against 15,791 there, unrelated histories — because it began as a
copy-paste rebrand with a flattened layout. Every "sync" since was a hand
re-application that drifted, which is why the tree sat on 7.3.1 while upstream
shipped fixes we then rediscovered by hand.
This commit's PARENT IS TAMAGUI. A future sync is `git merge tama/main` then
`node scripts/rebrand.mjs` — a real merge, because the history is now shared.
174 packages: 166 upstream, our 8 restored (chrome, shell, telemetry, recipes,
get, font-geist-{sans,mono}, @hanzo/booker), bento-get gained. 170/170 build.
Our patches to files UPSTREAM ALSO OWNS are carried, which the package-level
delta missed and which was where the value actually was:
- useMedia's server snapshot (`initState ?? getMedia()`). Upstream still
returns undefined there, so every Tamagui Dialog kills a prerender — the
exact crash hanzo.app spent a day on.
- data-slot on web host nodes, absent upstream entirely.
Both applied ONTO upstream's newer files (it rewrote useMedia +150/-63 and
createComponent +160/-55), marked `PATCH (ours, carried across the transplant)`.
Seven traps are encoded in scripts/rebrand.mjs, each found by a gate:
skip itself and lockfiles; special-case the double-branded names in BOTH scoped
and bare form; map path strings, not just paths; drop a level for the flattened
group; check disk rather than a stale index.
Rust build artifacts are NOT committed. An earlier draft of this commit swept
apps/desktop/src-tauri/target/debug in via `git add -A` — 3,859 files including
a 272MB .a, over GitHub's 100MB cap, so the push could never have landed. They
are gitignored now.
Co-Authored-By: Hanzo Dev <[email protected]>
46 lines
1.4 KiB
TypeScript
46 lines
1.4 KiB
TypeScript
import { renderToStaticMarkup } from 'react-dom/server'
|
|
import { describe, expect, it } from 'vitest'
|
|
import { renderSafeHtml } from '../renderSafeHtml'
|
|
|
|
describe('renderSafeHtml', () => {
|
|
it('preserves safe code-highlighting markup', () => {
|
|
const html = renderToStaticMarkup(
|
|
<code>
|
|
{renderSafeHtml('<span class="token keyword" data-line="1">const</span>')}
|
|
</code>
|
|
)
|
|
|
|
expect(html).toBe(
|
|
'<code><span class="token keyword" data-line="1">const</span></code>'
|
|
)
|
|
})
|
|
|
|
it('drops executable tags and attributes', () => {
|
|
const html = renderToStaticMarkup(
|
|
<code>
|
|
{renderSafeHtml(
|
|
'<span class="token keyword" onclick="alert(1)">const</span><script>alert(1)</script><img src=x onerror=alert(1)>'
|
|
)}
|
|
</code>
|
|
)
|
|
|
|
expect(html).toContain('<span class="token keyword">const</span>')
|
|
expect(html).not.toContain('onclick')
|
|
expect(html).not.toContain('<script')
|
|
expect(html).not.toContain('<img')
|
|
expect(html).not.toContain('onerror')
|
|
})
|
|
|
|
it('filters unsafe classes and data values', () => {
|
|
const html = renderToStaticMarkup(
|
|
<code>
|
|
{renderSafeHtml(
|
|
'<span class="token evil:hover [bad]" data-line="1" data-bad="javascript:alert(1)">x</span>'
|
|
)}
|
|
</code>
|
|
)
|
|
|
|
expect(html).toBe('<code><span class="token" data-line="1">x</span></code>')
|
|
})
|
|
})
|