First Commit. Duplicate bunext-sqlite preset

2026-10-18 16:47:11 +01:00
commit 81e4a8aecc
718 changed files with 41695 additions and 0 deletions
@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import sanitizeRichTextHtml from "./sanitize-rich-text-html";
+
+describe("sanitizeRichTextHtml", () => {
+    test("returns an empty string for empty input", () => {
+        expect(sanitizeRichTextHtml({ html: "" })).toBe("");
+        expect(sanitizeRichTextHtml({ html: null })).toBe("");
+        expect(sanitizeRichTextHtml({})).toBe("");
+    });
+
+    test("keeps safe formatting", () => {
+        expect(
+            sanitizeRichTextHtml({
+                html: "<p>Hello <strong>world</strong></p>",
+            }),
+        ).toBe("<p>Hello <strong>world</strong></p>");
+    });
+
+    test("strips script tags and their contents", () => {
+        const clean = sanitizeRichTextHtml({
+            html: `<p>Hi</p><script>alert("xss")</script>`,
+        });
+
+        expect(clean).toBe("<p>Hi</p>");
+        expect(clean).not.toContain("script");
+    });
+
+    test("strips event handler attributes", () => {
+        const clean = sanitizeRichTextHtml({
+            html: `<p onclick="alert(1)">Hi</p><img src="x" onerror="alert(1)">`,
+        });
+
+        expect(clean).not.toContain("onclick");
+        expect(clean).not.toContain("onerror");
+    });
+
+    test("strips unsafe URL schemes, including encoded ones", () => {
+        const clean = sanitizeRichTextHtml({
+            html: [
+                `<a href="javascript:alert(1)">a</a>`,
+                `<a href="jav&#x61;script:alert(1)">b</a>`,
+                `<a href="data:text/html,<script>alert(1)</script>">c</a>`,
+            ].join(""),
+        });
+
+        expect(clean).not.toContain("javascript");
+        expect(clean).not.toContain("data:");
+    });
+
+    test("strips iframes and forms", () => {
+        const clean = sanitizeRichTextHtml({
+            html: `<iframe src="https://example.com"></iframe><form><input></form><p>ok</p>`,
+        });
+
+        expect(clean).toBe("<p>ok</p>");
+    });
+
+    test("adds rel=noopener to links", () => {
+        const clean = sanitizeRichTextHtml({
+            html: `<a href="https://example.com" target="_blank">x</a>`,
+        });
+
+        expect(clean).toContain(`rel="noopener noreferrer"`);
+    });
+});