24 lines
918 B
TypeScript
24 lines
918 B
TypeScript
 
|
import { describe, test, expect } from 'vitest';
|
||
|
|
import { purifyHtml } from './HtmlBlock';
|
||
|
|
|
||
|
|
describe('purifyHtml', () => {
|
||
|
|
test('strips script tags', () => {
|
||
|
|
expect(purifyHtml('<p>ok</p><script>alert(1)</script>')).not.toContain('<script');
|
||
|
|
});
|
||
|
|
test('strips on-event handlers', () => {
|
||
|
|
const out = purifyHtml('<a onclick="bad()" href="/x">x</a>');
|
||
|
|
expect(out).not.toContain('onclick');
|
||
|
|
expect(out).toContain('href="/x"');
|
||
|
|
});
|
||
|
|
test('blocks javascript: URLs', () => {
|
||
|
|
expect(purifyHtml('<a href="javascript:void(0)">x</a>')).not.toContain('javascript:');
|
||
|
|
});
|
||
|
|
test('allows YouTube iframe', () => {
|
||
|
|
const out = purifyHtml('<iframe src="https://www.youtube.com/embed/abc" allowfullscreen></iframe>');
|
||
|
|
expect(out).toContain('youtube.com/embed/abc');
|
||
|
|
});
|
||
|
|
test('strips form/input', () => {
|
||
|
|
expect(purifyHtml('<form><input name="x"></form>')).not.toContain('<form');
|
||
|
|
});
|
||
|
|
});
|