From 009a963d2c3a63c363e046e4361636c071fe7972 Mon Sep 17 00:00:00 2001
From: electron-rare <108685187+electron-rare@users.noreply.github.com>
Date: Wed, 10 Jun 2026 21:35:38 +0200
Subject: [PATCH] test: pin data and vbscript url stripping

---
 src/lib/sanitize.test.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/lib/sanitize.test.ts b/src/lib/sanitize.test.ts
index e895657..9870f3b 100644
--- a/src/lib/sanitize.test.ts
+++ b/src/lib/sanitize.test.ts
@@ -9,6 +9,12 @@ describe('sanitizeHtml', () => {
   it('strips script/style/iframe and event handlers', () => {
     expect(sanitizeHtml('<p onclick="x()">a</p><script>evil()</script><iframe src="x"></iframe>')).toBe('<p>a</p>');
   });
+  it('strips data: and vbscript: urls', () => {
+    expect(sanitizeHtml('<a href="data:text/html,x">y</a>')).toBe('<a>y</a>');
+    expect(sanitizeHtml('<img src="data:image/svg+xml,x">')).toBe('<img>');
+    expect(sanitizeHtml('<a href="vbscript:x">y</a>')).toBe('<a>y</a>');
+  });
+
   it('keeps safe links and images, strips javascript: urls', () => {
     expect(sanitizeHtml('<a href="https://x.y">l</a><a href="javascript:e()">m</a><img src="https://x.y/i.png" alt="i">'))
       .toBe('<a href="https://x.y">l</a><a>m</a><img src="https://x.y/i.png" alt="i">');