import { describe, test, expect } from 'vitest';
import { TextBlock } from './TextBlock';

const toHtml = (TextBlock as any).toHtml;

describe('TextBlock.toHtml text escaping (attacker-controlled `text` prop)', () => {
  test('a tag-breakout attempt in text is neutralized (no injected element)', () => {
    const { html } = toHtml({ text: '</p><img src=x onerror=alert(1)>' }, '');
    expect(html).not.toContain('<img');
    expect(html).toContain('&lt;img');
  });

  test('ampersand is escaped for well-formed text content (consistency with escapeHtml)', () => {
    const { html } = toHtml({ text: 'Tom & Jerry' }, '');
    expect(html).toContain('Tom &amp; Jerry');
  });

  test('a normal text value still renders unchanged', () => {
    const { html } = toHtml({ text: 'Hello world' }, '');
    expect(html).toBe('<p>Hello world</p>');
  });
});