Node / meshtastic / Meshtastic-Android / files / desktopApp / src / test / kotlin / org / meshtastic / desktop / notification / WindowsNotificationSenderTest.kt

Displaying Raw • Download

T8b949e/*

* Copyright (c) 2026 Meshtastic LLC

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <https://www.gnu.org/licenses/>.

*/

Tff7b72package T7ee787org.meshtastic.desktop.notification

Tff7b72import T7ee787org.meshtastic.core.repository.Notification

Tff7b72import T7ee787kotlin.test.Test

Tff7b72import T7ee787kotlin.test.assertEquals

Tff7b72import T7ee787kotlin.test.assertFalse

Tff7b72import T7ee787kotlin.test.assertTrue

Tff7b72class T56d364WindowsNotificationSenderTest Tb4b4b4{

Tff7b72private Tff7b72val Te6edf3sender Tff7b72= Te6edf3WindowsNotificationSenderTb4b4b4(Te6edf3appName Tff7b72= Ta5d6ff"Ta5d6ffTestAppTa5d6ff"Tb4b4b4)

Tf0883e@Test

Tff7b72fun Td2a8ff`command starts with powershell`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3notification Tff7b72= Te6edf3NotificationTb4b4b4(Te6edf3title Tff7b72= Ta5d6ff"Ta5d6ffHiTa5d6ff"Tb4b4b4, Te6edf3message Tff7b72= Ta5d6ff"Ta5d6ffThereTa5d6ff"Tb4b4b4)

Tff7b72val Te6edf3cmd Tff7b72= Te6edf3senderTb4b4b4.Te6edf3buildCommandTb4b4b4(Te6edf3notificationTb4b4b4)

Te6edf3assertEqualsTb4b4b4(Ta5d6ff"Ta5d6ffpowershell.exeTa5d6ff"Tb4b4b4, Te6edf3cmdTff7b72[T79c0ff0Tff7b72]Tb4b4b4)

Te6edf3assertTrueTb4b4b4(Te6edf3cmdTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ff-NoProfileTa5d6ff"Tb4b4b4)Tb4b4b4)

Te6edf3assertTrueTb4b4b4(Te6edf3cmdTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ff-NonInteractiveTa5d6ff"Tb4b4b4)Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`silent notification sets audio silent`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3notification Tff7b72= Te6edf3NotificationTb4b4b4(Te6edf3title Tff7b72= Ta5d6ff"Ta5d6ffQuietTa5d6ff"Tb4b4b4, Te6edf3message Tff7b72= Ta5d6ff"Ta5d6ffShhhTa5d6ff"Tb4b4b4, Te6edf3isSilent Tff7b72= Tff7b72trueTb4b4b4)

Tff7b72val Te6edf3cmd Tff7b72= Te6edf3senderTb4b4b4.Te6edf3buildCommandTb4b4b4(Te6edf3notificationTb4b4b4)

Tff7b72val Te6edf3script Tff7b72= Te6edf3cmdTff7b72[Te6edf3cmdTb4b4b4.Te6edf3indexOfTb4b4b4(Ta5d6ff"Ta5d6ff-CommandTa5d6ff"Tb4b4b4) Tff7b72+ T79c0ff1Tff7b72]

Te6edf3assertTrueTb4b4b4(Te6edf3scriptTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ffsilent='true'Ta5d6ff"Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffExpected silent audio in: Tffd700$Te6edf3scriptTa5d6ff"Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`non-silent notification uses default sound`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3notification Tff7b72= Te6edf3NotificationTb4b4b4(Te6edf3title Tff7b72= Ta5d6ff"Ta5d6ffLoudTa5d6ff"Tb4b4b4, Te6edf3message Tff7b72= Ta5d6ff"Ta5d6ffHeyTa5d6ff"Tb4b4b4, Te6edf3isSilent Tff7b72= Tff7b72falseTb4b4b4)

Tff7b72val Te6edf3cmd Tff7b72= Te6edf3senderTb4b4b4.Te6edf3buildCommandTb4b4b4(Te6edf3notificationTb4b4b4)

Tff7b72val Te6edf3script Tff7b72= Te6edf3cmdTff7b72[Te6edf3cmdTb4b4b4.Te6edf3indexOfTb4b4b4(Ta5d6ff"Ta5d6ff-CommandTa5d6ff"Tb4b4b4) Tff7b72+ T79c0ff1Tff7b72]

Te6edf3assertTrueTb4b4b4(Te6edf3scriptTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ffNotification.DefaultTa5d6ff"Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffExpected default sound in: Tffd700$Te6edf3scriptTa5d6ff"Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`title and message passed as positional args`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3notification Tff7b72= Te6edf3NotificationTb4b4b4(Te6edf3title Tff7b72= Ta5d6ff"Ta5d6ffMy TitleTa5d6ff"Tb4b4b4, Te6edf3message Tff7b72= Ta5d6ff"Ta5d6ffMy MessageTa5d6ff"Tb4b4b4)

Tff7b72val Te6edf3cmd Tff7b72= Te6edf3senderTb4b4b4.Te6edf3buildCommandTb4b4b4(Te6edf3notificationTb4b4b4)

T8b949e// Last two args should be the title and message

Te6edf3assertEqualsTb4b4b4(Ta5d6ff"Ta5d6ffMy MessageTa5d6ff"Tb4b4b4, Te6edf3cmdTb4b4b4.Te6edf3lastTb4b4b4(Tb4b4b4)Tb4b4b4)

Te6edf3assertEqualsTb4b4b4(Ta5d6ff"Ta5d6ffMy TitleTa5d6ff"Tb4b4b4, Te6edf3cmdTff7b72[Te6edf3cmdTb4b4b4.Te6edf3size Tff7b72- T79c0ff2Tff7b72]Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`user content is not interpolated into script template`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3notification Tff7b72= Te6edf3NotificationTb4b4b4(Te6edf3title Tff7b72= Ta5d6ff"Ta5d6ff'; Drop-DatabaseTa5d6ff"Tb4b4b4, Te6edf3message Tff7b72= Ta5d6ff"Ta5d6ff<script>alert(1)</script>Ta5d6ff"Tb4b4b4)

Tff7b72val Te6edf3cmd Tff7b72= Te6edf3senderTb4b4b4.Te6edf3buildCommandTb4b4b4(Te6edf3notificationTb4b4b4)

Tff7b72val Te6edf3script Tff7b72= Te6edf3cmdTff7b72[Te6edf3cmdTb4b4b4.Te6edf3indexOfTb4b4b4(Ta5d6ff"Ta5d6ff-CommandTa5d6ff"Tb4b4b4) Tff7b72+ T79c0ff1Tff7b72]

T8b949e// Script should use $args[0] and $args[1], not raw user content

Te6edf3assertFalseTb4b4b4(Te6edf3scriptTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ffDrop-DatabaseTa5d6ff"Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffUser title leaked into script: Tffd700$Te6edf3scriptTa5d6ff"Tb4b4b4)

Te6edf3assertFalseTb4b4b4(Te6edf3scriptTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ff<script>Ta5d6ff"Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffUser message leaked into script: Tffd700$Te6edf3scriptTa5d6ff"Tb4b4b4)

T8b949e// But the positional args should carry the raw content

Te6edf3assertEqualsTb4b4b4(Ta5d6ff"Ta5d6ff<script>alert(1)</script>Ta5d6ff"Tb4b4b4, Te6edf3cmdTb4b4b4.Te6edf3lastTb4b4b4(Tb4b4b4)Tb4b4b4)

Te6edf3assertEqualsTb4b4b4(Ta5d6ff"Ta5d6ff'; Drop-DatabaseTa5d6ff"Tb4b4b4, Te6edf3cmdTff7b72[Te6edf3cmdTb4b4b4.Te6edf3size Tff7b72- T79c0ff2Tff7b72]Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`script uses SecurityElement Escape for XML safety`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3notification Tff7b72= Te6edf3NotificationTb4b4b4(Te6edf3title Tff7b72= Ta5d6ff"Ta5d6ffTestTa5d6ff"Tb4b4b4, Te6edf3message Tff7b72= Ta5d6ff"Ta5d6ffTestTa5d6ff"Tb4b4b4)

Tff7b72val Te6edf3cmd Tff7b72= Te6edf3senderTb4b4b4.Te6edf3buildCommandTb4b4b4(Te6edf3notificationTb4b4b4)

Tff7b72val Te6edf3script Tff7b72= Te6edf3cmdTff7b72[Te6edf3cmdTb4b4b4.Te6edf3indexOfTb4b4b4(Ta5d6ff"Ta5d6ff-CommandTa5d6ff"Tb4b4b4) Tff7b72+ T79c0ff1Tff7b72]

Te6edf3assertTrueTb4b4b4(Te6edf3scriptTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ff[System.Security.SecurityElement]::EscapeTa5d6ff"Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffExpected XML escaping in: Tffd700$Te6edf3scriptTa5d6ff"Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`appName with single quotes is escaped in script`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3evilSender Tff7b72= Te6edf3WindowsNotificationSenderTb4b4b4(Te6edf3appName Tff7b72= Ta5d6ff"Ta5d6ffMesh'EvilTa5d6ff"Tb4b4b4)

Tff7b72val Te6edf3notification Tff7b72= Te6edf3NotificationTb4b4b4(Te6edf3title Tff7b72= Ta5d6ff"Ta5d6ffTestTa5d6ff"Tb4b4b4, Te6edf3message Tff7b72= Ta5d6ff"Ta5d6ffTestTa5d6ff"Tb4b4b4)

Tff7b72val Te6edf3cmd Tff7b72= Te6edf3evilSenderTb4b4b4.Te6edf3buildCommandTb4b4b4(Te6edf3notificationTb4b4b4)

Tff7b72val Te6edf3script Tff7b72= Te6edf3cmdTff7b72[Te6edf3cmdTb4b4b4.Te6edf3indexOfTb4b4b4(Ta5d6ff"Ta5d6ff-CommandTa5d6ff"Tb4b4b4) Tff7b72+ T79c0ff1Tff7b72]

T8b949e// Single quotes should be doubled in PowerShell single-quoted strings

Te6edf3assertTrueTb4b4b4(Te6edf3scriptTb4b4b4.Te6edf3containsTb4b4b4(Ta5d6ff"Ta5d6ffMesh''EvilTa5d6ff"Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffExpected doubled quote in: Tffd700$Te6edf3scriptTa5d6ff"Tb4b4b4)

Tb4b4b4}

Tb4b4b4}