bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 22:37:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sanitize rendered web content (#77)

Browse source
This commit is contained in:
phucnguyen1707 2026-06-15 15:34:44 +07:00 • committed by GitHub
parent cb192906bd
commit 59013cf0af
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 167 additions and 133 deletions
Download patch file Download diff file Expand all files Collapse all files

19
apps/logicsrc-web/contract/html-sanitizer.test.ts Normal file
View file

@ -0,0 +1,19 @@
import { describe, expect, it } from "vitest";
import { sanitizeRenderedHtml } from "@/lib/html";
describe("sanitizeRenderedHtml", () => {
it("removes script tags, event handlers, and javascript URLs", () => {
const html = sanitizeRenderedHtml(
'<h2>Title</h2><p>Hello</p><script>alert(1)</script><img src="https://example.com/a.png" onerror="alert(1)"><a href="javascript:alert(1)">bad</a>'
);
expect(html).toContain("<h2>Title</h2>");
expect(html).toContain("<p>Hello</p>");
expect(html).toContain('<img src="https://example.com/a.png" />');
expect(html).toContain("<a>bad</a>");
expect(html).not.toContain("<script>");
expect(html).not.toContain("onerror");
expect(html).not.toContain("javascript:");
});
});