From a029931f76103e98d152ad3cd39a94b03b778de3 Mon Sep 17 00:00:00 2001
From: Virgil <virgil@lethean.io>
Date: Fri, 3 Apr 2026 17:49:16 +0000
Subject: [PATCH] fix(wasm): validate renderToString JS args

Co-Authored-By: Virgil <virgil@lethean.io>
---
 cmd/wasm/main.go      |  5 +++-
 cmd/wasm/main_test.go | 55 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 cmd/wasm/main_test.go

diff --git a/cmd/wasm/main.go b/cmd/wasm/main.go
index 4f2333d..fe79af2 100644
--- a/cmd/wasm/main.go
+++ b/cmd/wasm/main.go
@@ -16,11 +16,14 @@ func renderToString(_ js.Value, args []js.Value) any {
 	if len(args) < 1 {
 		return ""
 	}
+	if args[0].Type() != js.TypeString {
+		return ""
+	}
 
 	variant := args[0].String()
 	ctx := html.NewContext()
 
-	if len(args) >= 2 {
+	if len(args) >= 2 && args[1].Type() == js.TypeString {
 		ctx.SetLocale(args[1].String())
 	}
 
diff --git a/cmd/wasm/main_test.go b/cmd/wasm/main_test.go
new file mode 100644
index 0000000..4184caa
--- /dev/null
+++ b/cmd/wasm/main_test.go
@@ -0,0 +1,55 @@
+//go:build js && wasm
+
+package main
+
+import (
+	"testing"
+
+	"syscall/js"
+)
+
+func TestRenderToString_Good(t *testing.T) {
+	gotAny := renderToString(js.Value{}, []js.Value{
+		js.ValueOf("C"),
+		js.ValueOf("en-GB"),
+		js.ValueOf(map[string]any{"C": "<strong>hello</strong>"}),
+	})
+
+	got, ok := gotAny.(string)
+	if !ok {
+		t.Fatalf("renderToString should return string, got %T", gotAny)
+	}
+
+	want := `<main role="main" data-block="C-0"><strong>hello</strong></main>`
+	if got != want {
+		t.Fatalf("renderToString(...) = %q, want %q", got, want)
+	}
+}
+
+func TestRenderToString_VariantTypeGuard(t *testing.T) {
+	if got := renderToString(js.Value{}, []js.Value{js.ValueOf(123)}); got != "" {
+		t.Fatalf("non-string variant should be empty, got %q", got)
+	}
+
+	if got := renderToString(js.Value{}, []js.Value{}); got != "" {
+		t.Fatalf("missing variant should be empty, got %q", got)
+	}
+}
+
+func TestRenderToString_LocaleTypeGuard(t *testing.T) {
+	gotAny := renderToString(js.Value{}, []js.Value{
+		js.ValueOf("C"),
+		js.ValueOf(123),
+		js.ValueOf(map[string]any{"C": "x"}),
+	})
+
+	got, ok := gotAny.(string)
+	if !ok {
+		t.Fatalf("renderToString should return string, got %T", gotAny)
+	}
+
+	want := `<main role="main" data-block="C-0">x</main>`
+	if got != want {
+		t.Fatalf("renderToString with non-string locale = %q, want %q", got, want)
+	}
+}