@@ -16,6 +16,7 @@ const ReactDOMServerIntegrationUtils = require('./utils/ReactDOMServerIntegratio
1616
1717let React ;
1818let ReactDOM ;
19+ let ReactDOMClient ;
1920let ReactDOMServer ;
2021let ReactTestUtils ;
2122
@@ -34,12 +35,13 @@ describe('ReactDOMServerIntegration - Untrusted URLs', () => {
3435 jest . resetModules ( ) ;
3536 React = require ( 'react' ) ;
3637 ReactDOM = require ( 'react-dom' ) ;
38+ ReactDOMClient = require ( 'react-dom/client' ) ;
3739 ReactDOMServer = require ( 'react-dom/server' ) ;
3840 ReactTestUtils = require ( 'react-dom/test-utils' ) ;
3941
4042 // Make them available to the helpers.
4143 return {
42- ReactDOM ,
44+ ReactDOMClient ,
4345 ReactDOMServer,
4446 ReactTestUtils,
4547 } ;
@@ -169,9 +171,14 @@ describe('ReactDOMServerIntegration - Untrusted URLs', () => {
169171
170172 it ( 'rejects a javascript protocol href if it is added during an update' , ( ) => {
171173 const container = document . createElement ( 'div' ) ;
172- ReactDOM . render ( < a href = "thisisfine" > click me</ a > , container ) ;
174+ const root = ReactDOMClient . createRoot ( container ) ;
175+ ReactDOM . flushSync ( ( ) => {
176+ root . render ( < a href = "thisisfine" > click me</ a > ) ;
177+ } ) ;
173178 expect ( ( ) => {
174- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
179+ ReactDOM . flushSync ( ( ) => {
180+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
181+ } ) ;
175182 } ) . toErrorDev (
176183 'Warning: A future version of React will block javascript: URLs as a security precaution. ' +
177184 'Use event handlers instead if you can. If you need to generate unsafe HTML try using ' +
@@ -196,12 +203,13 @@ describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', (
196203
197204 React = require ( 'react' ) ;
198205 ReactDOM = require ( 'react-dom' ) ;
206+ ReactDOMClient = require ( 'react-dom/client' ) ;
199207 ReactDOMServer = require ( 'react-dom/server' ) ;
200208 ReactTestUtils = require ( 'react-dom/test-utils' ) ;
201209
202210 // Make them available to the helpers.
203211 return {
204- ReactDOM ,
212+ ReactDOMClient ,
205213 ReactDOMServer,
206214 ReactTestUtils,
207215 } ;
@@ -327,9 +335,14 @@ describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', (
327335
328336 it ( 'rejects a javascript protocol href if it is added during an update' , ( ) => {
329337 const container = document . createElement ( 'div' ) ;
330- ReactDOM . render ( < a href = "http://thisisfine/" > click me</ a > , container ) ;
331- expect ( container . firstChild . href ) . toBe ( 'http://thisisfine/' ) ;
332- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
338+ const root = ReactDOMClient . createRoot ( container ) ;
339+ ReactDOM . flushSync ( ( ) => {
340+ root . render ( < a href = "thisisfine" > click me</ a > ) ;
341+ } ) ;
342+ expect ( container . firstChild . href ) . toBe ( 'http://localhost/thisisfine' ) ;
343+ ReactDOM . flushSync ( ( ) => {
344+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
345+ } ) ;
333346 expect ( container . firstChild . href ) . toBe ( EXPECTED_SAFE_URL ) ;
334347 } ) ;
335348
@@ -371,13 +384,20 @@ describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', (
371384
372385 it ( 'rejects a javascript protocol href if it is added during an update twice' , ( ) => {
373386 const container = document . createElement ( 'div' ) ;
374- ReactDOM . render ( < a href = "http://thisisfine/" > click me</ a > , container ) ;
387+ const root = ReactDOMClient . createRoot ( container ) ;
388+ ReactDOM . flushSync ( ( ) => {
389+ root . render ( < a href = "http://thisisfine/" > click me</ a > ) ;
390+ } ) ;
375391 expect ( container . firstChild . href ) . toBe ( 'http://thisisfine/' ) ;
376- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
392+ ReactDOM . flushSync ( ( ) => {
393+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
394+ } ) ;
377395 expect ( container . firstChild . href ) . toBe ( EXPECTED_SAFE_URL ) ;
378396 // The second update ensures that a global flag hasn't been added to the regex
379397 // which would fail to match the second time it is called.
380- ReactDOM . render ( < a href = "javascript:notfine" > click me</ a > , container ) ;
398+ ReactDOM . flushSync ( ( ) => {
399+ root . render ( < a href = "javascript:notfine" > click me</ a > ) ;
400+ } ) ;
381401 expect ( container . firstChild . href ) . toBe ( EXPECTED_SAFE_URL ) ;
382402 } ) ;
383403} ) ;
0 commit comments