import { describe, test, expect } from 'vitest';
import { Spacer } from './Spacer';

const toHtml = (Spacer as any).toHtml;

describe('Spacer.toHtml normal rendering', () => {
  test('renders height into the style attribute', () => {
    const { html } = toHtml({ height: '80px' }, '');
    expect(html).toContain('height:80px');
  });
});

describe('Spacer.toHtml XSS hardening (height into style=)', () => {
  test('a height value with an attribute-breakout string cannot escape style=""', () => {
    const malicious = '40px" onmouseover="alert(1)';
    const { html } = toHtml({ height: malicious as any }, '');
    expect(html).not.toMatch(/"\s+onmouseover="/);
    expect(html).not.toMatch(/style="[^"]*"[^>]*onmouseover/);
  });

  test('a height value with a </style><script> breakout is neutralized', () => {
    const malicious = '40px</style><script>alert(1)</script>';
    const { html } = toHtml({ height: malicious as any }, '');
    expect(html).not.toContain('<script>alert(1)</script>');
  });
});