fix: improve pdf rendering and html

test/file-route-sandbox.test.js

@@ -0,0 +1,58 @@
+const { expect } = require("chai");
+require("ts-node/register/transpile-only");
+const { isScriptableDocument } = require("../src/server/routes/file");
+
+// A repository's own .html/.svg is served from our origin, so anything the
+// browser will render as a document (and run script from) has to carry the
+// CSP sandbox header — see the comment on the file route.
+describe("file route scriptable-document detection", function () {
+  it("flags markup the browser renders as a document", function () {
+    const scriptable = [
+      "index.html",
+      "docs/report.htm",
+      "page.xhtml",
+      "page.xht",
+      "figures/plot.svg",
+      "data/feed.xml",
+      "style.xsl",
+      "transform.xslt",
+      "archive.mhtml",
+    ];
+    scriptable.forEach((path) => {
+      expect(isScriptableDocument(path), path).to.equal(true);
+    });
+  });
+
+  it("is case insensitive on the extension", function () {
+    expect(isScriptableDocument("README.HTML")).to.equal(true);
+    expect(isScriptableDocument("logo.SVG")).to.equal(true);
+  });
+
+  it("leaves everything else alone", function () {
+    const inert = [
+      "README.md",
+      "src/index.js",
+      "report.pdf",
+      "photo.png",
+      "notes.txt",
+      "data.csv",
+      "archive.zip",
+      "notebook.ipynb",
+    ];
+    inert.forEach((path) => {
+      expect(isScriptableDocument(path), path).to.equal(false);
+    });
+  });
+
+  it("does not treat a directory suffix as the file's extension", function () {
+    // The extension has to come from the basename, not from anywhere in the
+    // path — "svg/logo" is a PNG-less file inside an svg/ directory.
+    expect(isScriptableDocument("assets.html/logo")).to.equal(false);
+    expect(isScriptableDocument("svg/drawing")).to.equal(false);
+  });
+
+  it("ignores files with no extension", function () {
+    expect(isScriptableDocument("LICENSE")).to.equal(false);
+    expect(isScriptableDocument("docs/Makefile")).to.equal(false);
+  });
+});