#!/usr/bin/env python3
"""Unit checks for theme validation and the customCss sanitiser."""
import os, sys
sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))
from market.theme import sanitize_css, sanitize_patch, build_theme_action, PRESETS
fails = 0
def check(name, cond):
global fails
fails += not cond
print(("PASS " if cond else "FAIL ") + name)
evil = ("@import url(https://evil.example/x.css); .card{color:red!important;position:fixed;z-index:99;--p-ink:transparent;"
"background:url(https://evil.example/t.png)} body{display:none} :root{--acc:red} h1{background:url(https://images.unsplash.com/a.jpg);margin:-500px}"
" .x{color:expression(alert(1))} .y{behavior:url(x.htc)} .z::before{content:'x'}"
" .t{transform:scale(0)} .k{color:blue}")
out = sanitize_css(evil)
check("css: @import stripped", "@" not in out and "evil.example/x.css" not in out)
check("css: !important stripped", "important" not in out)
check("css: position/z-index/content/transform dropped", not any(k in out for k in ("position", "z-index", "content", "transform")))
check("css: custom properties dropped", "--" not in out)
check("css: non-allowlisted url() neutralised", "evil.example" not in out and "url(https://images.unsplash.com/a.jpg)" in out)
check("css: body/:root selectors dropped", "body" not in out and ":root" not in out)
check("css: script/expression/behavior gone", not any(k in out.lower() for k in ("