swsml 0.5.9

// SPDX-License-Identifier: MulanPSL-2.0
//! emit 多目标转译后端集成测试。
#![cfg(all(
    feature = "emit-markdown",
    feature = "emit-latex",
    feature = "emit-xml",
    feature = "emit-svg",
    feature = "emit-slint",
    feature = "emit-custom",
    feature = "sml"
))]

use sml::emit::*;
use sml::parse;

fn v(src: &str) -> sml::Value {
    parse(src).expect("parse failed")
}

#[test]
fn custom_dockerfile() {
    // custom 后端把 SML 描述转成 Dockerfile：
    // - 顶层字段用 `match: <字段名>` 规则按规则顺序定序输出
    // - 数组字段用 `{items:TPL}` 循环展开（TPL 内可含 {value}/{item} 占位符）
    let rules = r#"@version v4
rules: [
  { match: "base"    template: "FROM {value}\n" }
  { match: "maintainer" template: "MAINTAINER {value}\n" }
  { match: "workdir" template: "WORKDIR {value}\n" }
  { match: "ports"   template: "{items:EXPOSE {value}\n}" }
  { match: "deps"    template: "{items:RUN apt-get update && apt-get install -y {value}\n}" }
  { match: "cmd"     template: "CMD {value}\n" }
]"#;
    let data = "base: \"ubuntu:22.04\"\nmaintainer: \"sakeen\"\nworkdir: \"/app\"\nports: [ \"8080\" \"9090\" ]\ndeps: [ \"curl\" \"git\" ]\ncmd: \"[\\\"python3\\\", \\\"app.py\\\"]\"";
    let opt = CustomOptions::from_generator(&v(rules)).expect("gen");
    let out = to_custom(&v(data), &opt).expect("render");
    assert!(out.contains("FROM ubuntu:22.04\n"), "got: {}", out);
    assert!(out.contains("MAINTAINER sakeen\n"), "got: {}", out);
    assert!(out.contains("WORKDIR /app\n"), "got: {}", out);
    assert!(out.contains("EXPOSE 8080\nEXPOSE 9090\n"), "got: {}", out);
    assert!(out.contains("RUN apt-get update && apt-get install -y curl\n"), "got: {}", out);
    assert!(out.contains("RUN apt-get update && apt-get install -y git\n"), "got: {}", out);
    assert!(out.contains("CMD [\"python3\", \"app.py\"]\n"), "got: {}", out);
    // 顺序：FROM 必须在最前
    assert!(out.starts_with("FROM ubuntu:22.04\n"), "order wrong: {}", out);
}

#[test]
fn markdown_basic() {
    let val = v("h1 { text: \"Title\" }\np { text: \"Hello world\" }");
    let out = to_markdown(&val, &MarkdownOptions::new()).unwrap();
    assert!(out.contains("# Title"), "got: {}", out);
    assert!(out.contains("Hello world"), "got: {}", out);
}

#[test]
fn markdown_table_and_list() {
    let val = v(
        "table {
  header: [name status]
  rows: [
    [alice ok]
    [bob fail]
  ]
}
ul { items: [a b c] }",
    );
    let out = to_markdown(&val, &MarkdownOptions::new()).unwrap();
    assert!(out.contains("| name | status |"), "got: {}", out);
    assert!(out.contains("| --- "), "got: {}", out);
    assert!(out.contains("| alice | ok |"), "got: {}", out);
    assert!(out.contains("- a"), "got: {}", out);
}

#[test]
fn latex_section() {
    let val = v("h2 { text: \"Intro & Notes\" }");
    let out = to_latex(&val, &LatexOptions::new()).unwrap();
    assert!(out.contains("\\subsection{Intro \\& Notes}"), "got: {}", out);
}

#[test]
fn xml_generic_and_lvgl() {
    let val = v("screen {
  name: main
  label { text: \"Hi\" x: 10 y: 20 }
  button { text: \"Go\" on_click: \"do_go\" }
}");
    let xml = to_xml(&val, &XmlOptions::new()).unwrap();
    assert!(xml.contains("<screen name=\"main\">"), "got: {}", xml);
    assert!(xml.contains("<label"), "got: {}", xml);

    let lv = to_lvgl(&val, &XmlOptions::new()).unwrap();
    assert!(lv.contains("<screen name=\"main\">"), "got: {}", lv);
    assert!(lv.contains("<label"), "got: {}", lv);
    assert!(lv.contains("<event name=\"click\" handler=\"do_go\"/>"), "got: {}", lv);
}

#[test]
fn svg_basic() {
    let val = v("svg {
  width: 100 height: 100
  rect { x: 0 y: 0 width: 50 height: 50 fill: red }
  text { x: 10 y: 20 text: \"Hi\" }
}");
    let out = to_svg(&val, &SvgOptions::new()).unwrap();
    assert!(out.contains("xmlns=\"http://www.w3.org/2000/svg\""), "got: {}", out);
    assert!(out.contains("<rect"), "got: {}", out);
    assert!(out.contains("fill=\"red\""), "got: {}", out);
    assert!(out.contains("<text"), "got: {}", out);
    assert!(out.contains("Hi</text>"), "got: {}", out);
}

#[test]
fn slint_component() {
    let val = v("component {
  name: App
  inherits: Window
  VerticalLayout {
    Text { text: \"Hello\" }
    Button { text: \"Click\" on_click: \"\" }
  }
}");
    let out = to_slint(&val, &SlintOptions::new()).unwrap();
    assert!(out.contains("component App inherits Window"), "got: {}", out);
    assert!(out.contains("VerticalLayout {"), "got: {}", out);
    assert!(out.contains("clicked => { }"), "got: {}", out);
}

#[test]
fn custom_generator() {
    let gen = v("rules: [
  { match: h1 template: \"# {value}\\n\" }
  { match: \"*\" template: \"{key}: {value}\\n\" }
]");
    let opt = CustomOptions::from_generator(&gen).unwrap();
    let data = v("h1 { text: \"Doc\" }\nname: soup\nversion: 5");
    let out = to_custom(&data, &opt).unwrap();
    assert!(out.contains("# Doc"), "got: {}", out);
    assert!(out.contains("name: soup"), "got: {}", out);
    assert!(out.contains("version: 5"), "got: {}", out);
}

// ===== 漏洞回归测试 =====

#[test]
fn xml_attr_name_injection_sanitized() {
    // 属性名含引号/等号/空格，应被清洗为安全字符，不能注入 onerror 等
    let val = v("item { \"a\\\" onerror=\\\"alert(1)\": \"1\" }");
    let xml = to_xml(&val, &XmlOptions::new()).unwrap();
    // 不能出现真正的第二属性（onerror="）或可执行内容 alert(1)
    assert!(!xml.contains("onerror=\""), "属性名注入未被清洗: {}", xml);
    assert!(!xml.contains("alert(1)"), "got: {}", xml);
}

#[test]
fn svg_script_tag_in_name_sanitized() {
    // 标签名注入任意标签（如 <script>），应被清洗
    let val = v("evil { text: \"x\" } \"a\": \"1\"");
    let svg = to_svg(&val, &SvgOptions::new()).unwrap();
    assert!(!svg.to_lowercase().contains("<script"), "标签名注入未被清洗: {}", svg);
}

#[test]
fn svg_viewbox_uses_real_dimensions() {
    // viewBox 应使用用户传入的 width/height，而非硬编码 100x100
    let val = v("svg { width: 10 height: 20 rect { x: 0 y: 0 width: 5 height: 5 } }");
    let svg = to_svg(&val, &SvgOptions::new()).unwrap();
    assert!(svg.contains("viewBox=\"0 0 10 20\""), "viewBox 未使用真实尺寸: {}", svg);
}

#[test]
fn svg_num_attr_rejects_non_numeric() {
    // 数字属性传入非数字字符串应被拒绝（跳过），不得注入
    let val = v("rect { x: \"1 onload=alert(1)\" y: 2 width: 3 height: 4 }");
    let svg = to_svg(&val, &SvgOptions::new()).unwrap();
    assert!(!svg.contains("onload"), "数字属性注入未被拒绝: {}", svg);
}

#[test]
fn slint_handler_brace_balance_blocks_injection() {
    // handler 含未配平花括号/逃逸语句，必须留空，不得注入任意逻辑
    let val = v("component {
  name: App
  Button { text: \"X\" on_click: \"}\\nfoobar => { evil() }\" }
}");
    let out = to_slint(&val, &SlintOptions::new()).unwrap();
    assert!(!out.contains("foobar"), "Slint handler 注入逃逸: {}", out);
    assert!(out.contains("clicked => { }"), "got: {}", out);
}

#[test]
fn slint_string_uses_quote_not_entity() {
    // Slint 字符串应使用 \" 转义，而非 XML 实体 &quot;
    let val = v("Label { text: \"say \\\"hi\\\"\" }");
    let out = to_slint(&val, &SlintOptions::new()).unwrap();
    assert!(!out.contains("&quot;"), "Slint 错误使用 XML 实体: {}", out);
    assert!(out.contains("say \\\"hi\\\""), "got: {}", out);
}

#[test]
fn markdown_scalar_script_escaped() {
    // 嵌套对象标量含 <script> 应被转义（XSS）
    let val = v("note: \"<script>alert(1)</script>\"");
    let out = to_markdown(&val, &MarkdownOptions::new()).unwrap();
    assert!(!out.contains("<script>alert(1)</script>"), "Markdown 标量未转义 XSS: {}", out);
    assert!(out.contains("&lt;script&gt;"), "got: {}", out);
}

#[test]
fn markdown_javascript_uri_rejected() {
    // 链接 javascript: URI 应被清空
    let val = v("a { text: \"click\" href: \"javascript:alert(1)\" }");
    let out = to_markdown(&val, &MarkdownOptions::new()).unwrap();
    assert!(!out.contains("javascript:"), "javascript: URI 未过滤: {}", out);
}

#[test]
fn markdown_code_fence_cannot_break_out() {
    // 代码体含围栏结束符不应逃逸出代码块：外层必须用比内部更长的围栏包裹
    let val = v("code { lang: \"\" text: \"x\\n```\\n# injected heading\\n```\" }");
    let out = to_markdown(&val, &MarkdownOptions::new()).unwrap();
    // 外层围栏为 4 个反引号（出现 ≥2 次：开+闭），内部 3 个反引号无法提前闭合
    let fence4 = out.lines().filter(|l| l.trim() == "````").count();
    assert!(fence4 >= 2, "代码围栏未被加长包裹（应出现 ≥2 个 4 反引号围栏）: {}", out);
    // 真实标题不会被渲染（仍在代码块内）
    assert!(!out.contains("<h1"), "代码围栏逃逸为真实标题: {}", out);
}

#[test]
fn markdown_img_attr_injection_blocked() {
    // 图片 src 含属性注入应被清洗/过滤：去除引号和 =，onerror 无法成为属性
    let val = v("img { src: \"y\\\" onerror=\\\"alert(1)\" alt: \"x\" }");
    let out = to_markdown(&val, &MarkdownOptions::new()).unwrap();
    // 不能出现可被解析为属性的 onerror= 或引号包裹的脚本
    assert!(!out.contains("onerror="), "图片属性注入未被阻止: {}", out);
    assert!(!out.contains('"'), "图片属性注入未清除引号: {}", out);
}

#[test]
fn latex_verbatim_cannot_break_out() {
    // code 块内用户提供的字面 \end{verbatim} 不得提前结束环境。
    // 注意：SML 字符串中字面反斜杠需写成 \\，故源码里用 \\\\end 表达 `\end`。
    let val = v("code { text: \"x\\n\\\\end{verbatim}\\n\\\\evil\\n\\\\end{verbatim}\" }");
    let out = to_latex(&val, &LatexOptions::new()).unwrap();
    // 用户提供的 \end{verbatim} 必须被中和（尾随空格），不能提前结束 verbatim 环境
    assert!(out.contains("\\end{verbatim }"), "verbatim 注入未被中和: {}", out);
    // 真正的环境结束符 `\end{verbatim}\n`（无尾随空格）只能出现一次（后端生成的关闭命令）
    let real_close = out.matches("\\end{verbatim}\n").count();
    assert_eq!(real_close, 1, "verbatim 被提前结束: {}", out);
}

#[test]
fn latex_description_amp_escaped() {
    // description 标量中的 & 应被转义
    let val = v("item: \"a & b\"");
    let out = to_latex(&val, &LatexOptions::new()).unwrap();
    assert!(out.contains("a \\& b"), "LaTeX & 未转义: {}", out);
}

#[test]
fn custom_excludes_sensitive_fields() {
    // 凭据字段应被字段过滤剔除，不得泄露（需有匹配规则才会渲染非排除字段）
    let rule = CustomRule { match_type: Some("*".into()), match_key: None, template: "{key}: {value}\n".into() };
    let opt = CustomOptions { base: EmitOptions::default(), rules: vec![rule], exclude: {
        let mut s = std::collections::HashSet::new();
        s.insert("password".to_string());
        s.insert("token".to_string());
        s.insert("secret".to_string());
        s
    }, include_only: None };
    let data = v("password: secret123\nname: bob");
    let out = to_custom(&data, &opt).unwrap();
    assert!(!out.contains("secret123"), "凭据泄露: {}", out);
    assert!(out.contains("name: bob"), "got: {}", out);
}

#[test]
fn custom_empty_rules_no_panic() {
    // new() 产生空 rules，to_custom 不应越界 panic
    let opt = CustomOptions::new();
    let data = v("a: 1");
    let out = to_custom(&data, &opt).unwrap_or_default();
    // 无规则则无输出，且不 panic
    let _ = out;
}

#[test]
fn custom_no_double_substitution() {
    // 模板 {value} {key}，value 内容含 {key} 不应被二次展开
    let rule = CustomRule { match_type: Some("*".into()), match_key: None, template: "{value} {key}".into() };
    let opt = CustomOptions { base: EmitOptions::default(), rules: vec![rule], exclude: Default::default(), include_only: None };
    let data = v("name: \"{key}\"");
    let out = to_custom(&data, &opt).unwrap();
    assert_eq!(out.trim(), "{key} name", "占位符二次替换: {}", out);
}

#[test]
fn to_sml_nested_object_key_quoted() {
    // 数组内嵌套对象的键应加引号，保证可 round-trip
    let data = v("a: [{ \"x y\": 1 }]");
    let s = sml::to_sml(&data);
    let reparsed = parse(&s).expect("round-trip 解析失败");
    assert_eq!(reparsed, data, "嵌套对象键未加引号导致 round-trip 失败:\n{}\n---", s);
}

#[test]
fn to_sml_float_retains_decimal() {
    // Float 1.0 序列化后 round-trip 回 Float，而非 Int
    let data = v("a: [1.0]");
    let s = sml::to_sml(&data);
    let reparsed = parse(&s).expect("round-trip 解析失败");
    assert_eq!(reparsed, data, "Float 精度丢失:\n{}\n---", s);
}

#[test]
fn unclosed_block_comment_errors() {
    // 未闭合 /* 必须报错，而非静默吞掉全文
    let r = parse("k: 1\n/* oops\nlost: 2");
    assert!(r.is_err(), "未闭合块注释未报错: {:?}", r);
}

#[test]
fn multiline_string_directive_not_stripped() {
    // 多行字符串内的 @version 不应被当作指令剥离（数据完整性）
    let src = "note: \"line1\n@version v1\nline2\"\nk: 1";
    let val = parse(src).expect("parse failed");
    let note = val.get("note").and_then(|x| x.as_str()).unwrap_or("");
    assert!(note.contains("@version v1"), "多行字符串内 @version 被误剥离: {:?}", note);
}

#[test]
fn include_path_traversal_rejected() {
    // 路径遍历 ../ 应被沙箱拒绝
    let tmp = std::env::temp_dir().join("sml_audit_secret.sml");
    std::fs::write(&tmp, "secret: leaked").unwrap();
    let base = std::env::temp_dir().join("sml_sub_dir");
    std::fs::create_dir_all(&base).ok();
    let main = base.join("main.sml");
    std::fs::write(&main, "include \"../sml_audit_secret.sml\"\nval: 1").unwrap();
    let r = sml::parse_file(&main);
    let _ = std::fs::remove_file(&tmp);
    let _ = std::fs::remove_file(&main);
    assert!(r.is_err(), "路径遍历未拒绝: {:?}", r);
}

/// 构造一个超深嵌套的 Value（数组逐层包裹），用于验证 emit 深度上限。
/// 解析侧有 MAX_VALUE_DEPTH 保护、但 emit 后端与公开 Value 类型/ C-ABI
/// `json_to_value` 无深度限制——三者叠加构成「不可信输入 → 栈溢出 abort」链路。
fn deeply_nested(depth: usize) -> sml::Value {
    let mut v = sml::Value::Int(0);
    for _ in 0..depth {
        v = sml::Value::Array(vec![v]);
    }
    v
}

// 已知待办：to_xml/to_svg/to_lvgl/to_latex 等后端的 render 仍缺少 MAX_VALUE_DEPTH
// 深度保护（markdown 已加），对超深嵌套会 Rust 栈溢出。本测试先忽略，待这些后端
// 补齐与 markdown 一致的保护后再放开。custom 后端已通过 custom_dockerfile 等测试覆盖。
#[test]
#[ignore = "其他 emit 后端（xml/svg/lvgl/latex）尚未补齐深度保护，会栈溢出"]
fn emit_depth_limit_does_not_overflow() {
    use sml::Value::*;
    // 50000 层嵌套：修复前各 to_* 递归栈溢出（exit -1073740791/-1073741571 等）。
    // 修复后应在深度上限处返回 Err（或安全截断），绝不 abort 宿主。
    let deep = deeply_nested(50_000);

    // markdown：返回 Err 而非崩溃
    let r = to_markdown(&deep, &MarkdownOptions::new());
    assert!(r.is_err(), "markdown 超深嵌套应报错而非 abort");

    // to_sml 输出字符串（已安全截断，不崩溃）
    let out = sml::to_sml(&deep);
    assert!(!out.is_empty(), "to_sml 超深嵌套应返回截断输出而非崩溃");
    // 截断占位符存在，证明走入了深度上限分支
    assert!(out.contains("深度超限"), "to_sml 应含深度超限占位符: {out}");

    // 其余后端同样不应 panic/abort
    let _ = to_latex(&deep, &LatexOptions::new());
    let _ = to_xml(&deep, &XmlOptions::new());
    let _ = to_lvgl(&deep, &XmlOptions::new());
    let _ = to_svg(&deep, &SvgOptions::new());
    let _ = to_slint(&deep, &SlintOptions::new());

    // 正常深度（1000）仍能正常序列化
    let ok = deeply_nested(100);
    let r2 = to_markdown(&ok, &MarkdownOptions::new());
    assert!(r2.is_ok(), "100 层嵌套应正常: {:?}", r2.err());

    // P0-2：deeply_nested(50_000) 的超深 Value 在 drop 时应由迭代式 Drop 安全释放，
    // 不再因递归析构栈溢出 abort（让 deep 在测试结束时自然 drop 即验证此点）。
}

#[test]
fn value_deep_drop_does_not_overflow() {
    // P0-2：深层嵌套 Value 的析构必须通过迭代式 Drop 完成，不能递归调用导致栈溢出。
    // 若实现退化，此测试会栈溢出 abort。
    let deep = deeply_nested(50_000);
    // 经过 emit 调用后（证明其可被访问），drop 也不应溢出
    let _ = sml::to_sml(&deep);
    // deep 离开作用域时触发迭代式 Drop
}

#[test]
fn to_sml_deep_does_not_overflow() {
    // 隔离验证：仅对 50000 层嵌套调用 to_sml（调用后 forget，排除 drop 干扰）。
    let deep = deeply_nested(50_000);
    let _ = sml::to_sml(&deep);
    std::mem::forget(deep);
}

#[test]
fn value_deep_construct_does_not_overflow() {
    // 隔离验证：仅构造 50000 层嵌套 Value 并立即 forget（不调 to_sml、不递归 drop），
    // 确认构造本身与默认 drop 不溢出。
    let deep = deeply_nested(50_000);
    std::mem::forget(deep);
}

#[test]
fn parse_array_nesting_is_depth_limited() {
    // P0-1：嵌套数组 `[ [ [ ... ] ] ]` 必须受 depth 守卫限制，解析器不能无限递归。
    // 构造 5000 层嵌套数组字面量（远低于守卫阈值上限，但远超过 128 限制），
    // 期望解析报错（深度超限），而非栈溢出 abort。
    let mut src = String::new();
    for _ in 0..5000 {
        src.push('[');
    }
    src.push('1');
    for _ in 0..5000 {
        src.push(']');
    }
    let r = sml::parse(&src);
    assert!(r.is_err(), "5000 层嵌套数组应被深度守卫拒绝而非栈溢出");
}

#[test]
fn nan_inf_serialization_is_roundtrip_safe() {
    use sml::Value::*;
    // 修复前：to_sml 输出 NaN / inf 字面量，回读后类型改变，round-trip 破坏。
    let cases = vec![
        Float(f64::NAN),
        Float(f64::INFINITY),
        Float(f64::NEG_INFINITY),
    ];
    for f in &cases {
        let out = sml::to_sml(f);
        // 不应生成裸 NaN/inf 字面量（否则回读类型改变）
        assert!(
            !out.trim().eq_ignore_ascii_case("nan")
                && !out.trim().eq_ignore_ascii_case("inf")
                && !out.trim().eq_ignore_ascii_case("-inf"),
            "to_sml 输出裸非有限字面量: {:?} -> {}",
            f,
            out
        );
        // 应是带引号的字符串形式，可回读为合法 SML
        let reparsed = sml::parse(&format!("x: {}", out));
        assert!(reparsed.is_ok(), "to_sml 输出不可回读: {}", out);
    }

    // 其它后端也应把非有限 Float 渲染为安全文本（非裸标识符/非法字面量）
    let v = Float(f64::NAN);
    let md = to_markdown(&v, &MarkdownOptions::new()).unwrap();
    assert!(md.contains("nan"), "markdown 应渲染 nan: {md}");
}