test: pin data and vbscript url stripping

2026-06-10 21:35:38 +02:00
parent d97aeb84d5
commit 009a963d2c
1 changed files with 6 additions and 0 deletions
@@ -9,6 +9,12 @@ describe('sanitizeHtml', () => {
  it('strips script/style/iframe and event handlers', () => {
    expect(sanitizeHtml('<p onclick="x()">a</p><script>evil()</script><iframe src="x"></iframe>')).toBe('<p>a</p>');
  });
+  it('strips data: and vbscript: urls', () => {
+    expect(sanitizeHtml('<a href="data:text/html,x">y</a>')).toBe('<a>y</a>');
+    expect(sanitizeHtml('<img src="data:image/svg+xml,x">')).toBe('<img>');
+    expect(sanitizeHtml('<a href="vbscript:x">y</a>')).toBe('<a>y</a>');
+  });
+
  it('keeps safe links and images, strips javascript: urls', () => {
    expect(sanitizeHtml('<a href="https://x.y">l</a><a href="javascript:e()">m</a><img src="https://x.y/i.png" alt="i">'))
      .toBe('<a href="https://x.y">l</a><a>m</a><img src="https://x.y/i.png" alt="i">');