/internal/output/sanitize_test.go

package output

import (
	"fmt"
	"strings"
	"testing"
	"unicode"
)

func FuzzAppendEscapedRune(f *testing.F) {
	f.Add(uint32(0x00))
	f.Add(uint32(0x1b))
	f.Add(uint32(0x7f))
	f.Add(uint32(0x80))
	f.Add(uint32(0xff))
	f.Add(uint32(0x100))
	f.Add(uint32(0x20ac))
	f.Add(uint32(0xffff))
	f.Add(uint32(0x10000))
	f.Add(uint32(0x10ffff))

	f.Fuzz(func(t *testing.T, raw uint32) {
		// keep this within the valid Unicode scalar range
		r := rune(raw % (unicode.MaxRune + 1))

		var b strings.Builder
		appendEscapedRune(&b, r)
		got := b.String()

		var want string
		switch {
		case r <= 0xFF:
			want = fmt.Sprintf(`\x%02x`, r)
		case r <= 0xFFFF:
			want = fmt.Sprintf(`\u%04x`, r)
		default:
			want = fmt.Sprintf(`\U%08x`, r)
		}

		if got != want {
			t.Fatalf("appendEscapedRune(%#x) = %q, want %q", r, got, want)
		}

		// output must be visible ascii
		for i := 0; i < len(got); i++ {
			if got[i] >= 0x80 {
				t.Fatalf("appendEscapedRune(%#x) produced non-ASCII byte 0x%02x in %q", r, got[i], got)
			}
		}
	})
}

// TestSanitizeTerminalEscapesControlBytes pins the human-readable contract: a
// raw ESC renders as the visible escape \x1b (a single backslash), with the
// surrounding printable bytes left intact.
func TestSanitizeTerminalEscapesControlBytes(t *testing.T) {
	in := "a\x1b[31mb"
	want := `a\x1b[31mb`
	if got := SanitizeTerminal(in); got != want {
		t.Fatalf("SanitizeTerminal(%q) = %q, want %q", in, got, want)
	}
}

// TestSanitizeTerminalLineEscapesLineBreakers verifies the single-line variant
// neutralizes the two characters SanitizeTerminal preserves (newline and tab),
// so an attacker-controlled field can't forge extra lines or shift columns,
// while still escaping ESC like the base sanitizer.
func TestSanitizeTerminalLineEscapesLineBreakers(t *testing.T) {
	cases := map[string]string{
		"cmd\nWarnings : none": `cmd\nWarnings : none`,
		"a\tb":                 `a\tb`,
		"x\x1b[2Jy":            `x\x1b[2Jy`,
		"plain":                "plain",
	}
	for in, want := range cases {
		if got := SanitizeTerminalLine(in); got != want {
			t.Errorf("SanitizeTerminalLine(%q) = %q, want %q", in, got, want)
		}
	}
}