'use strict'; const assert = require('node:assert/strict'); const test = require('node:test'); const uri = require('fast-uri'); const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom'); const yaml = require('js-yaml'); test('build dependency rejects malformed IPv6 instead of changing its destination', () => { assert.ok(uri.parse('http://[::not-valid]/example').error); assert.equal(uri.parse('https://example.com/path').host, 'example.com'); }); test('build XML dependency rejects invalid entity names at creation and strict serialization', () => { const document = new DOMImplementation().createDocument(null, 'example', null); const serializer = new XMLSerializer(); assert.throws(() => document.createEntityReference('bad; &suffix')); const reference = document.createEntityReference('valid'); // xmldom 0.8 exposes strict serialization as the fourth argument. assert.equal(serializer.serializeToString(reference, false, undefined, { requireWellFormed: true }), '&valid;'); reference.nodeName = 'bad; &suffix'; assert.throws(() => serializer.serializeToString(reference, false, undefined, { requireWellFormed: true })); }); test('build YAML dependency counts empty merge sources against the work budget', () => { const hostile = 'sources: &sources [{}, {}]\ntarget:\n <<: *sources\n'; assert.throws( () => yaml.load(hostile, { schema: yaml.YAML11_SCHEMA, maxTotalMergeKeys: 1 }), /merge keys exceeded maxTotalMergeKeys \(1\)/, ); assert.deepEqual(yaml.load('base: &base { enabled: true }\ntarget:\n <<: *base\n'), { base: { enabled: true }, target: { enabled: true }, }); });