fix(email-renderer): validate basic media and spacer dimensions

packages/email-renderer/test/marketing-images.test.ts

@@ -54,7 +54,7 @@ test("product and RSS images survive HTML, AMP and strict MJML exports", async (
     const result = await renderEmail(document(type, props), { amp: true, mjml: true });
     expect(result.ok).toBe(true);
     if (!result.ok) continue;
-    expect(result.value.parts.html.content).toContain('width:100%;max-width:320px;');
+    expect(result.value.parts.html.content).toContain("width:100%;max-width:320px;");
     for (const output of [
       result.value.parts.html.content,
       result.value.parts.amp?.content,
@@ -113,3 +113,39 @@ test("marketing image dimensions reject invalid or injected values", async () =>
     expect(result.ok).toBe(false);
   }
 });
+
+test("basic images, video thumbnails and spacers validate dimensions before rendering", async () => {
+  const cases: Array<{ type: string; props: Record<string, string> }> = [
+    { type: "content.image", props: { src: "https://example.com/image.png", alt: "Image" } },
+    {
+      type: "content.video",
+      props: {
+        href: "https://example.com/video",
+        thumbnail: "https://example.com/image.png",
+        title: "Video",
+        alt: "Video",
+      },
+    },
+    { type: "content.spacer", props: {} },
+  ];
+  for (const block of cases) {
+    for (const height of ["-1", "4001", "100%", "24;position:fixed", '24" onload="bad', "1e3"]) {
+      const result = await renderEmail(
+        document(block.type, { ...block.props, height } as Record<string, string>),
+      );
+      expect(result.ok).toBe(false);
+    }
+    const valid = await renderEmail(
+      document(block.type, { ...block.props, height: "4000" } as Record<string, string>),
+    );
+    expect(valid.ok).toBe(true);
+  }
+  expect((await renderEmail(document("content.spacer", { height: "0" }))).ok).toBe(true);
+  expect(
+    (
+      await renderEmail(
+        document("content.image", { src: "https://example.com/image.png", height: "0" }),
+      )
+    ).ok,
+  ).toBe(false);
+});