1package seedmark23import (4 "crypto/sha256"5 "encoding/json"6 "fmt"7 "os"8 "strings"9 "testing"10)1112// TestVersionOneMatchesUpstreamSVG pins the v1 output from Seedmark commit13// c808a940bc193f97512c02d58da33ecc28ba1f53. Seedmark is MIT licensed; its14// Go port and upstream license are in this package. The fixture generator is15// scripts/qa/generate-seedmark-fixture.mjs.16func TestVersionOneMatchesUpstreamSVG(t *testing.T) {17 raw, err := os.ReadFile("testdata/v1.json")18 if err != nil {19 t.Fatal(err)20 }21 var fixtures []struct{ Seed, Family, SHA256 string }22 if err := json.Unmarshal(raw, &fixtures); err != nil {23 t.Fatal(err)24 }25 families := map[string]bool{}26 if len(fixtures) != 1010 {27 t.Fatalf("fixtures contain %d cases, want 1010", len(fixtures))28 }29 for _, fixture := range fixtures {30 families[fixture.Family] = true31 digest := fmt.Sprintf("%x", sha256.Sum256([]byte(Avatar(fixture.Seed))))32 if digest != fixture.SHA256 {33 t.Fatalf("seed %q (%s): got SHA256 %s, want %s", fixture.Seed, fixture.Family, digest, fixture.SHA256)34 }35 }36 if len(families) != 8 {37 t.Fatalf("fixtures cover %d families", len(families))38 }39}4041func TestSeedNeverAppearsInMarkup(t *testing.T) {42 for _, seed := range []string{`<script>alert(1)</script>`, `" onload="alert(1)`, "https://example.test/identity"} {43 svg := Avatar(seed)44 if strings.Contains(svg, seed) || strings.Contains(svg, "<script") || strings.Contains(svg, "onload") || strings.Contains(svg, "href=") || strings.Contains(svg, "class=") {45 t.Fatalf("seed affected SVG markup: %s", svg)46 }47 }48}