@@ -72,7 +72,9 @@ describe('Script Generation', () => {
7272 email: faker.internet.email()
7373 };` ;
7474 expect ( result . script ) . to . contain ( expectedReturnBlock ) ;
75- expect ( result . script ) . to . contain ( 'use("testdb")' ) ;
75+ expect ( result . script ) . to . contain ( 'const DB_NAME = "testdb"' ) ;
76+ expect ( result . script ) . to . contain ( 'const COLL_NAME = "users"' ) ;
77+ expect ( result . script ) . to . contain ( 'use(DB_NAME)' ) ;
7678 expect ( result . script ) . to . contain ( 'insertMany' ) ;
7779
7880 // Test that the generated document code is executable
@@ -382,13 +384,17 @@ describe('Script Generation', () => {
382384
383385 expect ( result1 . success ) . to . equal ( true ) ;
384386 if ( result1 . success ) {
385- expect ( result1 . script ) . to . contain ( 'use("test\'db`with\\"quotes")' ) ;
386387 expect ( result1 . script ) . to . contain (
387- 'getCollection("coll\\nwith\\ttabs") '
388+ 'const DB_NAME = "test\'db`with\\"quotes" '
388389 ) ;
390+ expect ( result1 . script ) . to . contain (
391+ 'const COLL_NAME = "coll\\nwith\\ttabs"'
392+ ) ;
393+ expect ( result1 . script ) . to . contain ( 'use(DB_NAME)' ) ;
394+ expect ( result1 . script ) . to . contain ( 'getCollection(COLL_NAME)' ) ;
389395 // Should not contain unescaped special characters that could break JS
390- expect ( result1 . script ) . not . to . contain ( "use( 'test'db" ) ;
391- expect ( result1 . script ) . not . to . contain ( "getCollection( 'coll\nwith" ) ;
396+ expect ( result1 . script ) . not . to . contain ( "DB_NAME = 'test'db" ) ;
397+ expect ( result1 . script ) . not . to . contain ( "COLL_NAME = 'coll\nwith" ) ;
392398
393399 // Test that the generated document code is executable
394400 testDocumentCodeExecution ( result1 . script ) ;
@@ -407,9 +413,11 @@ describe('Script Generation', () => {
407413 // eslint-disable-next-line @typescript-eslint/no-implied-eval
408414 expect ( ( ) => new Function ( result2 . script ) ) . to . not . throw ( ) ;
409415
410- // Verify template literal characters are properly escaped in console.log
411- expect ( result2 . script ) . to . contain ( 'test\\`\\${}' ) ;
412- expect ( result2 . script ) . to . contain ( 'collection\\`\\${}' ) ;
416+ // Verify template literal characters are properly handled in constants via JSON.stringify
417+ expect ( result2 . script ) . to . contain ( 'const DB_NAME = "test`${}"' ) ;
418+ expect ( result2 . script ) . to . contain ( 'const COLL_NAME = "collection`${}"' ) ;
419+ expect ( result2 . script ) . to . contain ( 'use(DB_NAME)' ) ;
420+ expect ( result2 . script ) . to . contain ( 'getCollection(COLL_NAME)' ) ;
413421
414422 // Test that the generated document code is executable
415423 testDocumentCodeExecution ( result2 . script ) ;
@@ -438,28 +446,23 @@ describe('Script Generation', () => {
438446 // eslint-disable-next-line @typescript-eslint/no-implied-eval
439447 expect ( ( ) => new Function ( result . script ) ) . to . not . throw ( ) ;
440448
441- // Verify malicious code is safely contained in string
442- expect ( result . script ) . to . contain (
443- 'use(\'test`; require("fs").rmSync("/"); //\')'
444- ) ;
445- expect ( result . script ) . to . contain ( 'getCollection(\'my "collection"\')' ) ;
446-
447- // Verify template literal injection is prevented (backticks are escaped)
449+ // Verify malicious code is safely contained in DB_NAME and COLL_NAME constants
450+ // Note: prettier may split long lines and uses single quotes when string contains double quotes
448451 expect ( result . script ) . to . contain (
449- 'test\\ `; require("fs").rmSync("/"); //'
452+ '\'test `; require("fs").rmSync("/"); //\' '
450453 ) ;
451-
452- // Verify malicious code in name is safely contained in code comment
453454 expect ( result . script ) . to . contain (
454- '// Generated for database: test`; require("fs").rmSync("/"); //; collection: my "collection"'
455+ 'const COLL_NAME = \' my "collection"\' '
455456 ) ;
457+ expect ( result . script ) . to . contain ( 'use(DB_NAME)' ) ;
458+ expect ( result . script ) . to . contain ( 'getCollection(COLL_NAME)' ) ;
456459
457460 // Test that the generated document code is executable
458461 testDocumentCodeExecution ( result . script ) ;
459462 }
460463 } ) ;
461464
462- it ( 'should sanitize newlines in database and collection names in comments ' , ( ) => {
465+ it ( 'should sanitize newlines in database and collection names in constants ' , ( ) => {
463466 const schema = {
464467 field : {
465468 mongoType : 'String' as const ,
@@ -477,10 +480,15 @@ describe('Script Generation', () => {
477480
478481 expect ( result . success ) . to . equal ( true ) ;
479482 if ( result . success ) {
480- // Verify newlines are replaced with spaces in comments to prevent syntax errors
483+ // Verify newlines are escaped in constants via JSON.stringify
484+ expect ( result . script ) . to . contain (
485+ 'const DB_NAME = "test\\nwith\\nnewlines"'
486+ ) ;
481487 expect ( result . script ) . to . contain (
482- '// Generated for database: test with newlines; collection: coll with returns '
488+ 'const COLL_NAME = " coll\\rwith\\r\\nreturns" '
483489 ) ;
490+ expect ( result . script ) . to . contain ( 'use(DB_NAME)' ) ;
491+ expect ( result . script ) . to . contain ( 'getCollection(COLL_NAME)' ) ;
484492
485493 // Verify the script is still syntactically valid
486494 // eslint-disable-next-line @typescript-eslint/no-implied-eval
0 commit comments