Add tests for validation of user input

[hindessc]

Additionally adds tests that check that all blocks accepting user input are covered

Part of #701

Summary by CodeRabbit

• Tests
  • Added security coverage for color validation, including malformed values and code-injection attempts.
  • Added validation for free-text inputs to ensure generated code safely escapes content.
  • Added checks for procedure names, unsupported blocks, and tune generation.
  • Added a dedicated security test suite accessible from the test runner.

[coderabbitai]

Warning

Review limit reached

@hindessc, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: eae9110e-9c45-4e40-bd28-321fdaff865c

📥 Commits

Reviewing files that changed from the base of the PR and between a484fe9 and fd519d7.

📒 Files selected for processing (1)

• tests/security/free-text-validation.test.js

📝 Walkthrough

Walkthrough

The PR adds security tests for Blockly color and free-text JavaScript generator fields, covering valid output, invalid input fallback, injection payload handling, unsupported blocks, and automatic discovery of free-text fields. The tests are registered as a selectable security suite.

Changes

Security generator validation

Layer / File(s)	Summary
Color generator validation tests/security/color-validation.test.js	Adds tests for valid colors, invalid formats and names, default black output, and code-injection attempts.
Free-text generator validation tests/security/free-text-validation.test.js	Discovers text fields and verifies safe output for text, prompt, procedure, tune, and keyword blocks.
Security suite registration tests/security/index.test.js, tests/tests.html	Combines both security test runners and registers the selectable security suite with the @security filter.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: adding tests that validate user input handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

tests/security/free-text-validation.test.js (1)

8-8: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove unused constant.

The allBlockTypes array is never referenced and can be safely removed.

♻️ Proposed refactor

-const allBlockTypes = Object.keys(Blockly.Blocks).sort();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/security/free-text-validation.test.js` at line 8, Remove the unused
allBlockTypes constant declaration from the test file, leaving the surrounding
security validation setup unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/security/free-text-validation.test.js`:
- Around line 54-62: Update the test workspace lifecycle around the shared
workspace declaration and test suite hooks so each test starts with a clean
Blockly workspace and the workspace is disposed after the suite completes,
preventing retained blocks and global leaks. Revise the comment above generate
to describe unwrapping blockToCode results generally, without referencing
colour_from_string or a specific block type.

---

Nitpick comments:
In `@tests/security/free-text-validation.test.js`:
- Line 8: Remove the unused allBlockTypes constant declaration from the test
file, leaving the surrounding security validation setup unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6e697f82-3448-4578-9a6d-50ed7827d225

📥 Commits

Reviewing files that changed from the base of the PR and between 0e3d02b and a484fe9.

📒 Files selected for processing (4)

• tests/security/color-validation.test.js
• tests/security/free-text-validation.test.js
• tests/security/index.test.js
• tests/tests.html