package config

import (
	"strings"
	"testing"
)

// TestLinksRefuseOtherSchemes: the console renders these as hrefs, so a
// javascript: or data: URL in the config must not get that far.
func TestLinksRefuseOtherSchemes(t *testing.T) {
	for _, bad := range []string{"javascript:alert(1)", "data:text/html,x", "//grafana.example", "grafana.example/d/1"} {
		c := Default()
		c.API.Links.Grafana = bad
		err := c.Validate()
		if err == nil || !strings.Contains(err.Error(), "api.links.grafana") {
			t.Errorf("%q accepted: %v", bad, err)
		}
	}
	c := Default()
	c.Block.Enabled = false
	c.API.Links = Links{Grafana: "https://g.example/d/1", Logs: "http://loki.internal/x"}
	if err := c.Validate(); err != nil {
		t.Errorf("valid links rejected: %v", err)
	}
}