@@ -16,6 +16,7 @@ const ReactDOMServerIntegrationUtils = require('./utils/ReactDOMServerIntegratio
16
16
17
17
let React ;
18
18
let ReactDOM ;
19
+ let ReactDOMClient ;
19
20
let ReactDOMServer ;
20
21
let ReactTestUtils ;
21
22
@@ -34,12 +35,13 @@ describe('ReactDOMServerIntegration - Untrusted URLs', () => {
34
35
jest . resetModules ( ) ;
35
36
React = require ( 'react' ) ;
36
37
ReactDOM = require ( 'react-dom' ) ;
38
+ ReactDOMClient = require ( 'react-dom/client' ) ;
37
39
ReactDOMServer = require ( 'react-dom/server' ) ;
38
40
ReactTestUtils = require ( 'react-dom/test-utils' ) ;
39
41
40
42
// Make them available to the helpers.
41
43
return {
42
- ReactDOM ,
44
+ ReactDOMClient ,
43
45
ReactDOMServer,
44
46
ReactTestUtils,
45
47
} ;
@@ -169,9 +171,14 @@ describe('ReactDOMServerIntegration - Untrusted URLs', () => {
169
171
170
172
it ( 'rejects a javascript protocol href if it is added during an update' , ( ) => {
171
173
const container = document . createElement ( 'div' ) ;
172
- ReactDOM . render ( < a href = "thisisfine" > click me</ a > , container ) ;
174
+ const root = ReactDOMClient . createRoot ( container ) ;
175
+ ReactDOM . flushSync ( ( ) => {
176
+ root . render ( < a href = "thisisfine" > click me</ a > ) ;
177
+ } ) ;
173
178
expect ( ( ) => {
174
- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
179
+ ReactDOM . flushSync ( ( ) => {
180
+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
181
+ } ) ;
175
182
} ) . toErrorDev (
176
183
'Warning: A future version of React will block javascript: URLs as a security precaution. ' +
177
184
'Use event handlers instead if you can. If you need to generate unsafe HTML try using ' +
@@ -196,12 +203,13 @@ describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', (
196
203
197
204
React = require ( 'react' ) ;
198
205
ReactDOM = require ( 'react-dom' ) ;
206
+ ReactDOMClient = require ( 'react-dom/client' ) ;
199
207
ReactDOMServer = require ( 'react-dom/server' ) ;
200
208
ReactTestUtils = require ( 'react-dom/test-utils' ) ;
201
209
202
210
// Make them available to the helpers.
203
211
return {
204
- ReactDOM ,
212
+ ReactDOMClient ,
205
213
ReactDOMServer,
206
214
ReactTestUtils,
207
215
} ;
@@ -327,9 +335,14 @@ describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', (
327
335
328
336
it ( 'rejects a javascript protocol href if it is added during an update' , ( ) => {
329
337
const container = document . createElement ( 'div' ) ;
330
- ReactDOM . render ( < a href = "http://thisisfine/" > click me</ a > , container ) ;
338
+ const root = ReactDOMClient . createRoot ( container ) ;
339
+ ReactDOM . flushSync ( ( ) => {
340
+ root . render ( < a href = "http://thisisfine" > click me</ a > ) ;
341
+ } ) ;
331
342
expect ( container . firstChild . href ) . toBe ( 'http://thisisfine/' ) ;
332
- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
343
+ ReactDOM . flushSync ( ( ) => {
344
+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
345
+ } ) ;
333
346
expect ( container . firstChild . href ) . toBe ( EXPECTED_SAFE_URL ) ;
334
347
} ) ;
335
348
@@ -371,13 +384,20 @@ describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', (
371
384
372
385
it ( 'rejects a javascript protocol href if it is added during an update twice' , ( ) => {
373
386
const container = document . createElement ( 'div' ) ;
374
- ReactDOM . render ( < a href = "http://thisisfine/" > click me</ a > , container ) ;
387
+ const root = ReactDOMClient . createRoot ( container ) ;
388
+ ReactDOM . flushSync ( ( ) => {
389
+ root . render ( < a href = "http://thisisfine/" > click me</ a > ) ;
390
+ } ) ;
375
391
expect ( container . firstChild . href ) . toBe ( 'http://thisisfine/' ) ;
376
- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
392
+ ReactDOM . flushSync ( ( ) => {
393
+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
394
+ } ) ;
377
395
expect ( container . firstChild . href ) . toBe ( EXPECTED_SAFE_URL ) ;
378
396
// The second update ensures that a global flag hasn't been added to the regex
379
397
// which would fail to match the second time it is called.
380
- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
398
+ ReactDOM . flushSync ( ( ) => {
399
+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
400
+ } ) ;
381
401
expect ( container . firstChild . href ) . toBe ( EXPECTED_SAFE_URL ) ;
382
402
} ) ;
383
403
} ) ;
0 commit comments