14 lines
463 B
TypeScript
14 lines
463 B
TypeScript
import { expect, test } from "bun:test";
|
|
import { jsx } from "../src/jsx-runtime.ts";
|
|
|
|
test("JSX rejects dynamic tag-name injection", () => {
|
|
expect(() => jsx("div><script>alert(1)</script><div" as "div", {})).toThrow(
|
|
"Invalid JSX tag name",
|
|
);
|
|
});
|
|
|
|
test("JSX skips invalid spread attribute names", () => {
|
|
const html = jsx("div", { 'title" onmouseover="alert(1)': "x", title: "safe" }).toString();
|
|
expect(html).toBe('<div title="safe"></div>');
|
|
});
|