html-sanitizer.test.ts•1.56 kB
// src/__tests__/utils/html-sanitizer.test.ts
import { escapeHtml } from '../../utils/html-sanitizer';
describe('HTML Sanitizer', () => {
describe('escapeHtml', () => {
it('should escape HTML special characters', () => {
expect(escapeHtml('<script>alert("XSS")</script>')).toBe('<script>alert("XSS")</script>');
});
it('should handle ampersands correctly', () => {
expect(escapeHtml('This & that')).toBe('This & that');
});
it('should handle quotes correctly', () => {
expect(escapeHtml('Single \' and double " quotes')).toBe('Single ' and double " quotes');
});
it('should handle non-string inputs by converting to string', () => {
expect(escapeHtml(123)).toBe('123');
expect(escapeHtml(null)).toBe('null');
expect(escapeHtml(undefined)).toBe('undefined');
expect(escapeHtml(true)).toBe('true');
});
it('should handle empty strings', () => {
expect(escapeHtml('')).toBe('');
});
it('should not modify strings without special characters', () => {
expect(escapeHtml('Normal text without special chars')).toBe('Normal text without special chars');
});
it('should handle complex HTML correctly', () => {
const input = '<a href="javascript:alert(\'XSS\')" onclick="alert(\'XSS\')">Click me</a>';
const expected = '<a href="javascript:alert('XSS')" onclick="alert('XSS')">Click me</a>';
expect(escapeHtml(input)).toBe(expected);
});
});
});