secure_output 0.1.2

Context-aware output encoding and URI sanitization for safer application responses.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

//! Property tests — output encoding invariants.
//!
//! Milestone 9 — BDD: HTML encode safety.
use proptest::prelude::*;
use secure_output::encode::OutputEncoder;
use secure_output::html::HtmlEncoder;

proptest! {
    /// HTML-encoded output never contains raw dangerous characters
    #[test]
    fn prop_html_encode_no_raw_special_chars(s in ".*") {
        let enc = HtmlEncoder;
        let encoded = enc.encode(&s);
        prop_assert!(!encoded.contains('<'), "raw '<' found in: {encoded}");
        prop_assert!(!encoded.contains('>'), "raw '>' found in: {encoded}");
        prop_assert!(!encoded.contains('"'), "raw '\"' found in: {encoded}");
        prop_assert!(!encoded.contains('\''), "raw '\\'' found in: {encoded}");
    }

    /// HTML encode never panics on arbitrary input
    #[test]
    fn prop_html_encode_no_panic(s in ".*") {
        let enc = HtmlEncoder;
        let _ = enc.encode(&s);
    }

    /// HTML encoded output never contains a literal <script tag (XSS protection)
    #[test]
    fn prop_html_encode_no_script_tag(s in ".*") {
        let enc = HtmlEncoder;
        let encoded = enc.encode(&s);
        let lower = encoded.to_lowercase();
        prop_assert!(!lower.contains("<script"), "script tag found in: {encoded}");
    }
}