Swadhin Biswas test(qa): add e2e, integration, unit, and load coverage · 3/6/2026
1c29e63
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
import { escapeHtml, sanitizeHtml } from "@/lib/sanitize";
import { describe, expect, it } from "vitest";
describe("sanitizeHtml", () => {
it("removes script tags", () => {
expect(sanitizeHtml('<script>alert("xss")</script>')).not.toContain(
"<script",
);
});
it("removes script tags with attributes", () => {
expect(sanitizeHtml('<script src="evil.js"></script>')).not.toContain(
"<script",
);
});
it("removes event handler attributes", () => {
const result = sanitizeHtml('<img src="x" onerror="alert(1)" />');
expect(result).not.toContain("onerror");
});
it("removes onclick handlers", () => {
const result = sanitizeHtml('<button onclick="steal()">Click</button>');
expect(result).not.toContain("onclick");
});
it("removes javascript: URIs", () => {
const result = sanitizeHtml('<a href="javascript:alert(1)">link</a>');
expect(result).not.toContain("javascript:");
});
it("removes iframe tags", () => {
const result = sanitizeHtml('<iframe src="http://evil.com"></iframe>');
expect(result).not.toContain("<iframe");
});
it("removes object tags", () => {
const result = sanitizeHtml('<object data="malware.swf"></object>');
expect(result).not.toContain("<object");
});
it("removes embed tags", () => {
const result = sanitizeHtml('<embed src="malware.swf" />');
expect(result).not.toContain("<embed");
});
it("removes form tags", () => {
const result = sanitizeHtml(
'<form action="http://evil.com"><input /></form>',
);
expect(result).not.toContain("<form");
});
it("allows safe tags", () => {
const safe = "<p>Hello <strong>world</strong></p>";
const result = sanitizeHtml(safe);
expect(result).toContain("<p>");
expect(result).toContain("<strong>");
});
it("handles empty string", () => {
expect(sanitizeHtml("")).toBe("");
});
it("handles plain text", () => {
expect(sanitizeHtml("Hello world")).toBe("Hello world");
});
it("handles nested malicious tags", () => {
const result = sanitizeHtml(
"<div><script><script>alert(1)</script></script></div>",
);
expect(result).not.toContain("<script");
});
});
describe("escapeHtml", () => {
it("escapes ampersands", () => {
expect(escapeHtml("foo & bar")).toBe("foo & bar");
});
it("escapes less-than", () => {
expect(escapeHtml("a < b")).toBe("a < b");
});
it("escapes greater-than", () => {
expect(escapeHtml("a > b")).toBe("a > b");
});
it("escapes double quotes", () => {
expect(escapeHtml('say "hello"')).toBe("say "hello"");
});
it("escapes single quotes", () => {
const result = escapeHtml("it's");
expect(result).toContain("&#");
});
it("handles empty string", () => {
expect(escapeHtml("")).toBe("");
});
it("handles already safe text", () => {
expect(escapeHtml("Hello world")).toBe("Hello world");
});
it("escapes all special chars combined", () => {
const result = escapeHtml("<script>\"alert('xss')&</script>");
expect(result).not.toContain("<");
expect(result).not.toContain(">");
expect(result).toContain("&");
});
});