diff --git a/ui/src/ui/views/chat-image-open.browser.test.ts b/ui/src/ui/views/chat-image-open.browser.test.ts index 9f2090a139b..500e1c01d69 100644 --- a/ui/src/ui/views/chat-image-open.browser.test.ts +++ b/ui/src/ui/views/chat-image-open.browser.test.ts @@ -16,15 +16,16 @@ function renderAssistantImage(url: string) { } describe("chat image open safety", () => { - it("opens safe image URLs in a hardened new tab", async () => { + it("opens only safe image URLs in a hardened new tab", async () => { const app = mountApp("/chat"); await app.updateComplete; const openSpy = vi.spyOn(window, "open").mockReturnValue(null); + app.chatMessages = [renderAssistantImage("https://example.com/cat.png")]; await app.updateComplete; - const image = app.querySelector(".chat-message-image"); + let image = app.querySelector(".chat-message-image"); expect(image).not.toBeNull(); image?.dispatchEvent(new MouseEvent("click", { bubbles: true })); @@ -34,34 +35,24 @@ describe("chat image open safety", () => { "_blank", "noopener,noreferrer", ); - }); - it("does not open unsafe image URLs", async () => { - const app = mountApp("/chat"); - await app.updateComplete; - - const openSpy = vi.spyOn(window, "open").mockReturnValue(null); + openSpy.mockClear(); app.chatMessages = [renderAssistantImage("javascript:alert(1)")]; await app.updateComplete; - const image = app.querySelector(".chat-message-image"); + image = app.querySelector(".chat-message-image"); expect(image).not.toBeNull(); image?.dispatchEvent(new MouseEvent("click", { bubbles: true })); expect(openSpy).not.toHaveBeenCalled(); - }); - it("does not open SVG data image URLs", async () => { - const app = mountApp("/chat"); - await app.updateComplete; - - const openSpy = vi.spyOn(window, "open").mockReturnValue(null); + openSpy.mockClear(); app.chatMessages = [ renderAssistantImage("data:image/svg+xml,"), ]; await app.updateComplete; - const image = app.querySelector(".chat-message-image"); + image = app.querySelector(".chat-message-image"); expect(image).not.toBeNull(); image?.dispatchEvent(new MouseEvent("click", { bubbles: true }));