ds4/spec/expression-evaluation/validator.spec.ts

// SPDX-FileCopyrightText: 2022 Johannes Loher
//
// SPDX-License-Identifier: MIT

import { describe, expect, it } from "vitest";

import { literals, safeOperators } from "../../src/expression-evaluation/grammar";
import { Validator } from "../../src/expression-evaluation/validator";

describe("Validator", () => {
  it("allows identifier according to the given predicate", () => {
    // given
    const predicate = (identifier: string) => identifier === "true";
    const validator = new Validator(predicate);
    const input = "true";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).not.toThrow();
  });

  it("disallows identifier according to the given predicate", () => {
    // given
    const predicate = (identifier: string) => identifier === "false";
    const validator = new Validator(predicate);
    const input = "true";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).toThrowError("'true' is not an allowed identifier");
  });

  it("allows multiple identifiers according to the given predicate", () => {
    // given
    const predicate = (identifier: string) => identifier === "true" || identifier === "null";
    const validator = new Validator(predicate);
    const input = "true null";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).not.toThrow();
  });

  it("allows multiple identifiers in a more complex expression according to the given rule", () => {
    // given
    const predicate = (identifier: string) => identifier === "true" || identifier === "null";
    const validator = new Validator(predicate);
    const input = "true === null";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).not.toThrow();
  });

  it("mentions the first not allowed identifier in the thrown errror", () => {
    // given
    const predicate = (identifier: string) => identifier === "true" || identifier === "null";
    const validator = new Validator(predicate);
    const input = "true === null && undefined === false";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).toThrowError("'undefined' is not an allowed identifier.");
  });

  it("disallows invalid invalid tokens", () => {
    // given
    const validator = new Validator();
    const input = ";";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).toThrowError("Invalid or unexpected token (0)");
  });

  it("allows a complicated valid expression", () => {
    // given
    const predicate = (identifier: string) => [...safeOperators, ...literals, "floor", "random"].includes(identifier);
    const validator = new Validator(predicate);
    const input = "typeof (floor(random() * 5) / 2) === 'number' ? 42 : 'foo'";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).not.toThrow();
  });

  it("disallows a complicated expression if it contains a disallowed identifier", () => {
    // given
    const predicate = (identifier: string) => [...safeOperators, ...literals, "ceil"].includes(identifier);
    const validator = new Validator(predicate);
    const input = "ceil.constructor('alert(1); return 1;')()";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).toThrowError("'constructor' is not an allowed identifier.");
  });

  it("disallows arrow functions", () => {
    // given
    const validator = new Validator();
    const input = "() => {}";

    // when
    const validate = () => validator.validate(input);

    // then
    expect(validate).toThrowError("Invalid or unexpected token (3)");
  });
});