Repository: facebook/react
File: packages/react-dom/src/__tests__/ReactDOMServerIntegrationUntrustedURL-test.js (JavaScript)

Code before:

  it('rejects a javascript protocol href if it is added during an update', async () => {
    const container = document.createElement('div');
    const root = ReactDOMClient.createRoot(container);
    await act(async () => {
      root.render(<a href="thisisfine">click me</a>);
    });
    await expect(async () => {
      await act(() => {
        root.render(<a href="javascript:notfine">click me</a>);
      });
    }).toErrorDev(
      'Warning: A future version of React will block javascript: URLs as a security precaution. ' +
        'Use event handlers instead if you can. If you need to generate unsafe HTML try using ' +
        'dangerouslySetInnerHTML instead. React was passed "javascript:notfine".\n' +
        '    in a (at **)',
    );
  });
});

describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', () => {
  // The `itRenders` helpers don't work with the gate pragma, so we have to do
  // this instead.
  if (gate(flags => !flags.disableJavaScriptURLs)) {
    it("empty test so Jest doesn't complain", () => {});
    return;
  }

  function initModules() {
    jest.resetModules();
    const ReactFeatureFlags = require('shared/ReactFeatureFlags');
    ReactFeatureFlags.disableJavaScriptURLs = true;

    React = require('react');
    ReactDOMServer = require('react-dom/server');
    ReactTestUtils = require('react-dom/test-utils');

    // Make them available to the helpers.
    return {
      ReactDOM,
      ReactDOMServer,
      ReactTestUtils,
    };
  }

  const {
    resetModules,
    itRenders,
    clientRenderOnBadMarkup,
    clientRenderOnServerString,
  } = ReactDOMServerIntegrationUtils(initModules);

Review comment (bug):
You'll need to keep this, because it's returned from `initModules` below, which is passed to `ReactDOMServerIntegrationUtils`. That's why the tests are failing ✨

Code after:

  it('rejects a javascript protocol href if it is added during an update', async () => {
    const container = document.createElement('div');
    const root = ReactDOMClient.createRoot(container);
    await act(async () => {
      root.render(<a href="thisisfine">click me</a>);
    });
    await expect(async () => {
      await act(() => {
        root.render(<a href="javascript:notfine">click me</a>);
      });
    }).toErrorDev(
      'Warning: A future version of React will block javascript: URLs as a security precaution. ' +
        'Use event handlers instead if you can. If you need to generate unsafe HTML try using ' +
        'dangerouslySetInnerHTML instead. React was passed "javascript:notfine".\n' +
        '    in a (at **)',
    );
  });
});

describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', () => {
  // The `itRenders` helpers don't work with the gate pragma, so we have to do
  // this instead.
  if (gate(flags => !flags.disableJavaScriptURLs)) {
    it("empty test so Jest doesn't complain", () => {});
    return;
  }

  function initModules() {
    jest.resetModules();
    const ReactFeatureFlags = require('shared/ReactFeatureFlags');
    ReactFeatureFlags.disableJavaScriptURLs = true;

    React = require('react');
    ReactDOM = require('react-dom');
    ReactDOMClient = require('react-dom/client');
    ReactDOMServer = require('react-dom/server');
    ReactTestUtils = require('react-dom/test-utils');
    act = require('internal-test-utils').act;

    // Make them available to the helpers.
    return {
      ReactDOM,
      ReactDOMServer,
      ReactTestUtils,
    };
  }

  const {
    resetModules,
    itRenders,