AkurAI-Framework / tests/js/rich-text.test.mjs

Latest change f77b709bd5d10a720dc73afb8db12765666bb659 - OLI-244: virtual-list and rich-text islands with sanitizer, node tests, docs by Ólafur Búi Ólafsson

import test from "node:test";
import assert from "node:assert/strict";
import { sanitizeHtml } from "../../site/frontend/rich-text.js";

test("keeps basic formatting", () => {
  assert.equal(sanitizeHtml("<p>a <b>b</b> <i>c</i></p>"), "<p>a <b>b</b> <i>c</i></p>");
});
test("drops script and style with content", () => {
  assert.equal(sanitizeHtml("x<script>alert(1)</script><style>p{}</style>y"), "xy");
});
test("strips event handlers and unknown attributes", () => {
  assert.equal(sanitizeHtml('<b onclick="x()" style="a:b">t</b>'), "<b>t</b>");
});
test("allows safe links, rejects javascript: urls", () => {
  assert.equal(sanitizeHtml('<a href="https://e.com/x?a=1&b=2">l</a>'), '<a href="https://e.com/x?a=1&amp;b=2" rel="noopener noreferrer">l</a>');
  assert.equal(sanitizeHtml('<a href="javascript:alert(1)">l</a>'), "<a>l</a>");
  assert.equal(sanitizeHtml('<a href=" JaVaScRiPt:alert(1)">l</a>'), "<a>l</a>");
});
test("unknown tags are unwrapped, text stays escaped", () => {
  assert.equal(sanitizeHtml("<iframe>hi</iframe> 1 < 2"), "hi 1 &lt; 2");
});