Hello",
+ expected:
+ "
<div><p>Hello
"
+ },
+ {
+ title: "mismatched closing tags",
+ input: "
",
+ expected: "
"
+ },
+ {
+ title: "unclosed body tag in fragment",
+ input: "
Hello
",
+ expected: "
Hello
"
+ }
+];
+
+describe("normalizeToHtmlBody", () => {
+ HTML_INPUT_TYPES.forEach(({ title, input, expected }) => {
+ it(`should normalize ${title}`, () => {
+ expect(normalizeToHtmlBody(input)).toBe(expected);
+ });
+ });
+
+ it("should always return html and body sequence at root", () => {
+ for (const { input } of HTML_INPUT_TYPES) {
+ const normalized = normalizeToHtmlBody(input).toLowerCase();
+ expect(normalized.startsWith("")).toBe(true);
+ expect(normalized.includes("
")).toBe(true);
+ }
+ });
+
+ it("should handle runtime non-string values safely", () => {
+ expect(normalizeToHtmlBody(null as unknown as string)).toBe(
+ ""
+ );
+ expect(normalizeToHtmlBody(undefined as unknown as string)).toBe(
+ ""
+ );
+ });
+});
+
+// sanitizeHtml uses globalThis.DOMParser (set to linkedom's DOMParser in
+// test.setup.ts) to back DOMPurify when a native browser DOM is unavailable.
+describe("sanitizeHtml", () => {
+ it("strips ");
+ expect(result).not.toContain(" {
+ const result = sanitizeHtml('
');
+ expect(result).not.toContain("onerror");
+ expect(result).not.toContain("alert(1)");
+ });
+
+ it("strips javascript: URIs from href", () => {
+ // eslint-disable-next-line no-script-url
+ const result = sanitizeHtml('click');
+ expect(result).not.toContain("javascript:");
+ expect(result).toContain("click");
+ });
+
+ it("strips javascript: URIs from src", () => {
+ // eslint-disable-next-line no-script-url
+ const result = sanitizeHtml(
+ ''
+ );
+ expect(result).not.toContain("javascript:");
+ });
+
+ it("strips onclick and other on* attributes", () => {
+ const result = sanitizeHtml(
+ 'x
'
+ );
+ expect(result).not.toContain("onclick");
+ expect(result).not.toContain("onmouseover");
+ expect(result).not.toContain("evil()");
+ });
+
+ it("strips