import { describe, test, expect } from 'vitest';
import { ImageBlock } from './ImageBlock';

const toHtml = (ImageBlock as any).toHtml;

describe('ImageBlock.toHtml src/alt XSS hardening', () => {
  test('a javascript: src never reaches the output', () => {
    const { html } = toHtml({ src: 'javascript:alert(1)' }, '');
    expect(html).not.toContain('javascript:');
  });

  test('a malicious src cannot break out of the src attribute', () => {
    const malicious = 'https://example.com/x.jpg" onerror="alert(1)';
    const { html } = toHtml({ src: malicious }, '');
    expect(html).not.toContain('onerror="alert(1)"');
  });

  test('a malicious alt cannot break out of the alt attribute', () => {
    const malicious = 'x" onerror="alert(1)';
    const { html } = toHtml({ src: 'https://example.com/x.jpg', alt: malicious }, '');
    expect(html).not.toContain('onerror="alert(1)"');
  });

  test('a placeholder/empty src emits no output', () => {
    const { html } = toHtml({ src: '' }, '');
    expect(html).toBe('');
  });

  test('a normal image still renders correctly', () => {
    const { html } = toHtml({ src: 'https://example.com/photo.jpg', alt: 'A photo' }, '');
    expect(html).toContain('src="https://example.com/photo.jpg"');
    expect(html).toContain('alt="A photo"');
  });
});