import { expect, test } from "bun:test";
import { jsx } from "../src/jsx-runtime.ts";

test("JSX rejects dynamic tag-name injection", () => {
  expect(() => jsx("div><script>alert(1)</script><div" as "div", {})).toThrow(
    "Invalid JSX tag name",
  );
});

test("JSX skips invalid spread attribute names", () => {
  const html = jsx("div", { 'title" onmouseover="alert(1)': "x", title: "safe" }).toString();
  expect(html).toBe('<div title="safe"></div>');
});