fix(cv): enforce readable render palettes

Choose a contrasting header foreground for custom accents and keep public colour and font overrides inside safe supported values.
2026-08-15 17:08:20 +02:00
parent f0b9b222ff
commit 3b86ea2da0
8 changed files with 98 additions and 18 deletions
@@ -210,6 +210,36 @@ public sealed class CvBuilderTests
        Assert.DoesNotContain("transform:scale", html);
    }

+    [Fact]
+    public void Header_band_and_sidebar_contact_text_own_their_contrasting_palette()
+    {
+        var renderer = new ThemedCvRenderer();
+        var model = CvVariantResolver.Build(Rich(), new CvVariantSettings(), "F", null);
+        var modern = renderer.Render(model, CvThemeCatalog.Resolve("modern"), new CvVariantSettings { ThemeId = "modern" }).Html;
+        var lightAccent = renderer.Render(model, CvThemeCatalog.Resolve("modern"), new CvVariantSettings { ThemeId = "modern", AccentColor = "#f8fafc" }).Html;
+        var technicalTheme = CvThemeCatalog.Resolve("technical");
+        var technical = renderer.Render(model, technicalTheme, new CvVariantSettings { ThemeId = "technical" }).Html;
+
+        Assert.Contains(".header-band .name,.header-band .headline,.header-band .contact,.header-band .contact-item,.header-band a{color:#fff;}", modern);
+        Assert.Contains(".header-band .name,.header-band .headline,.header-band .contact,.header-band .contact-item,.header-band a{color:#000;}", lightAccent);
+        Assert.Contains($".sidebar .contact,.sidebar .headline,.sidebar .entry-meta,.sidebar .entry-subtitle{{color:{technicalTheme.SidebarInk};}}", technical);
+    }
+
+    [Fact]
+    public void Variant_settings_reject_css_injection_in_visual_overrides()
+    {
+        var settings = CvVariantSettingsJson.Normalize(new CvVariantSettings
+        {
+            AccentColor = "#fff;} </style><script>alert(1)</script>",
+            HeadingFont = "Arial;}</style><script>alert(2)</script>",
+            BodyFont = "'Segoe UI', Roboto, Arial, sans-serif",
+        });
+
+        Assert.Null(settings.AccentColor);
+        Assert.Null(settings.HeadingFont);
+        Assert.Equal("'Segoe UI', Roboto, Arial, sans-serif", settings.BodyFont);
+    }
+
    [Fact]
    public void Accent_override_reaches_the_css()
    {