feat: productionize learning engine and classroom
This commit is contained in:
@@ -56,6 +56,14 @@ describe('patchHtmlForIframe', () => {
|
||||
expect(out.indexOf('</head>')).toBeLessThan(out.indexOf('<div>'));
|
||||
});
|
||||
|
||||
it('blocks network access for interactive HTML in the Makelore offline player', () => {
|
||||
const out = patchHtmlForIframe('<html><head></head><body></body></html>', { offline: true });
|
||||
expect(out).toContain('data-makelore-offline-csp');
|
||||
expect(out).toContain("connect-src 'none'");
|
||||
expect(out).toContain("frame-src 'none'");
|
||||
expect(out.indexOf('data-makelore-offline-csp')).toBeLessThan(out.indexOf('<body>'));
|
||||
});
|
||||
|
||||
it('does not treat head-like text in comments or scripts as the document head', () => {
|
||||
const authoredScript = 'const template = "<head>"; window.__template = template;';
|
||||
const html = `<!doctype html><!-- <head> --><html><body><script>${authoredScript}</script></body></html>`;
|
||||
|
||||
Reference in New Issue
Block a user