adk-browser 0.6.0

Browser automation tools for Rust Agent Development Kit (ADK-Rust) agents using WebDriver
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

//! String escaping utilities for safe JavaScript interpolation.

/// Escape a string for safe interpolation into JavaScript code.
///
/// This prevents CSS selector injection attacks when user-supplied
/// selectors are interpolated into JavaScript strings. It escapes
/// characters that could break out of a JS string literal or inject
/// malicious code.
///
/// # Example
///
/// ```
/// use adk_browser::escape_js_string;
///
/// let safe = escape_js_string("div[data-id='test']");
/// assert!(safe.contains("\\'"));  // single quotes are escaped
/// ```
pub fn escape_js_string(input: &str) -> String {
    let mut escaped = String::with_capacity(input.len() + 16);
    for ch in input.chars() {
        match ch {
            '\\' => escaped.push_str("\\\\"),
            '\'' => escaped.push_str("\\'"),
            '"' => escaped.push_str("\\\""),
            '`' => escaped.push_str("\\`"),
            '\n' => escaped.push_str("\\n"),
            '\r' => escaped.push_str("\\r"),
            '\0' => escaped.push_str("\\0"),
            '<' => escaped.push_str("\\x3c"),
            '>' => escaped.push_str("\\x3e"),
            _ => escaped.push(ch),
        }
    }
    escaped
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_escape_single_quotes() {
        assert_eq!(escape_js_string("a'b"), "a\\'b");
    }

    #[test]
    fn test_escape_double_quotes() {
        assert_eq!(escape_js_string("a\"b"), "a\\\"b");
    }

    #[test]
    fn test_escape_backslash() {
        assert_eq!(escape_js_string("a\\b"), "a\\\\b");
    }

    #[test]
    fn test_escape_backtick() {
        assert_eq!(escape_js_string("a`b"), "a\\`b");
    }

    #[test]
    fn test_escape_newlines() {
        assert_eq!(escape_js_string("a\nb"), "a\\nb");
        assert_eq!(escape_js_string("a\rb"), "a\\rb");
    }

    #[test]
    fn test_escape_null_byte() {
        assert_eq!(escape_js_string("a\0b"), "a\\0b");
    }

    #[test]
    fn test_escape_script_tags() {
        assert_eq!(escape_js_string("</script>"), "\\x3c/script\\x3e");
    }

    #[test]
    fn test_escape_normal_selector() {
        assert_eq!(escape_js_string("#my-button"), "#my-button");
        assert_eq!(escape_js_string(".nav-link"), ".nav-link");
        assert_eq!(escape_js_string("button[type=submit]"), "button[type=submit]");
    }

    #[test]
    fn test_escape_injection_attempt() {
        let malicious = "'); document.cookie='stolen'; ('";
        let escaped = escape_js_string(malicious);
        // The single quotes are escaped, so the string can't break out of a JS literal
        assert!(escaped.starts_with("\\'"));
        assert!(escaped.contains("\\'"));
    }

    #[test]
    fn test_escape_empty_string() {
        assert_eq!(escape_js_string(""), "");
    }
}