package templ import ( "bytes" "context" "testing" "github.com/google/go-cmp/cmp" ) // Note: use of the RawEventHandler and JSFuncCall in ExpressionAttributes is tested in the parser package. func TestJSUnsafeFuncCall(t *testing.T) { tests := []struct { name string js string expected ComponentScript }{ { name: "alert", js: "alert('hello')", expected: ComponentScript{ Name: "jsUnsafeFuncCall_bc8b29d9abedc43cb4d79ec0af23be8c4255a4b76691aecf23ba3b0b8ab90011", Function: "", // Note that the Call field is attribute encoded. Call: "alert('hello')", // Whereas the CallInline field is what you would see inside a `, }, { name: "single argument is supported", functionName: "alert", args: []any{"hello"}, expected: ComponentScript{ Name: "jsFuncCall_92df7244f17dc5bfc41dfd02043df695e4664f8bf42c265a46d79b32b97693d0", Function: "", Call: "alert("hello")", CallInline: `alert("hello")`, }, expectedComponentOutput: ``, }, { name: "multiple arguments are supported", functionName: "console.log", args: []any{"hello", "world"}, expected: ComponentScript{ Name: "jsFuncCall_2b3416c14fc2700d01e0013e7b7076bb8dd5f3126d19e2e801de409163e3960c", Function: "", Call: "console.log("hello","world")", CallInline: `console.log("hello","world")`, }, expectedComponentOutput: ``, }, { name: "attribute injection fails", functionName: `" onmouseover="alert('hello')`, args: nil, expected: ComponentScript{ Name: "jsFuncCall_e56d1214f3b4fbf27406f209e3f4a58c2842fa2760b6d83da5ee72e04c89f913", Function: "", Call: "__templ_invalid_js_function_name()", CallInline: "__templ_invalid_js_function_name()", }, expectedComponentOutput: ``, }, { name: "closing the script and injecting HTML fails", functionName: `