improved tests

functions/src/deno_runtime.rs

@@ -192,3 +192,63 @@ impl DenoRuntime {
         Ok((stdout, stderr, status, headers))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use serde_json::{json, Value};
+
+    /// Validates that the double-serialization technique produces safe JS string
+    /// literals, even when the payload contains characters that could break out
+    /// of a JS template if interpolated naively.
+    #[test]
+    fn test_double_serialize_escapes_js_injection() {
+        let malicious_payload = json!({
+            "key": "\"); process.exit(1); //"
+        });
+
+        let first = serde_json::to_string(&malicious_payload).unwrap();
+        let double = serde_json::to_string(&first).unwrap();
+
+        // The double-serialized value must be a valid JSON string
+        let recovered_first: String = serde_json::from_str(&double).unwrap();
+        let recovered: Value = serde_json::from_str(&recovered_first).unwrap();
+        assert_eq!(recovered, malicious_payload);
+    }
+
+    #[test]
+    fn test_double_serialize_handles_backtick_injection() {
+        let payload = json!({
+            "attack": "${globalThis.Deno.exit()}"
+        });
+
+        let first = serde_json::to_string(&payload).unwrap();
+        let double = serde_json::to_string(&first).unwrap();
+
+        // The value when placed in a JS template literal is still just a string
+        let recovered_first: String = serde_json::from_str(&double).unwrap();
+        let recovered: Value = serde_json::from_str(&recovered_first).unwrap();
+        assert_eq!(recovered, payload);
+    }
+
+    #[test]
+    fn test_double_serialize_handles_empty() {
+        let payload = json!({});
+        let first = serde_json::to_string(&payload).unwrap();
+        let double = serde_json::to_string(&first).unwrap();
+
+        let recovered_first: String = serde_json::from_str(&double).unwrap();
+        let recovered: Value = serde_json::from_str(&recovered_first).unwrap();
+        assert_eq!(recovered, payload);
+    }
+
+    #[test]
+    fn test_double_serialize_preserves_unicode() {
+        let payload = json!({"emoji": "🔐", "chinese": "安全"});
+        let first = serde_json::to_string(&payload).unwrap();
+        let double = serde_json::to_string(&first).unwrap();
+
+        let recovered_first: String = serde_json::from_str(&double).unwrap();
+        let recovered: Value = serde_json::from_str(&recovered_first).unwrap();
+        assert_eq!(recovered, payload);
+    }
+}