14 lines
874 B
TypeScript
14 lines
874 B
TypeScript
import { expect, test } from "bun:test";
|
|
import { JSDOM } from "jsdom";
|
|
import { builderPreviewHTML } from "../src/preview-html.ts";
|
|
|
|
test("preview sanitization preserves email layout and editor markers but removes executable content", () => {
|
|
const { window } = new JSDOM("");
|
|
const result = String(builderPreviewHTML('<html><head><style>td{padding:12px}</style></head><body><table data-block-id="one"><tr><td><img src="https://example.com/a.png" onerror="alert(1)"><a href="javascript:alert(1)">Hello</a></td></tr></table><script>alert(1)</script><iframe src="https://example.com"></iframe></body></html>', window.document as unknown as Document));
|
|
expect(result).toContain('data-block-id="one"');
|
|
expect(result).toContain('<table');
|
|
expect(result).toContain('<style>');
|
|
expect(result).not.toMatch(/onerror|javascript:|<script|<iframe/);
|
|
window.close();
|
|
});
|