Nexus.Reader/tests/NexusReader.Application.Tests/Services/HtmlSanitizerServiceTests.cs

using FluentAssertions;
using NexusReader.Infrastructure.Services;
using Xunit;

namespace NexusReader.Application.Tests.Services;

public class HtmlSanitizerServiceTests
{
    [Fact]
    public void Sanitize_WithSafeInput_ReturnsSameInput()
    {
        // Arrange
        var service = new HtmlSanitizerService();
        var input = "<p>This is a safe <strong>paragraph</strong>.</p>";

        // Act
        var result = service.Sanitize(input);

        // Assert
        result.Should().Be(input);
    }

    [Fact]
    public void Sanitize_WithScriptTag_StripsScriptTag()
    {
        // Arrange
        var service = new HtmlSanitizerService();
        var input = "<p>Hello</p><script>alert('xss')</script>";

        // Act
        var result = service.Sanitize(input);

        // Assert
        result.Should().NotContain("<script>");
        result.Should().NotContain("alert");
        result.Should().Be("<p>Hello</p>");
    }

    [Fact]
    public void Sanitize_WithOnEventHandlerAttribute_StripsOnError()
    {
        // Arrange
        var service = new HtmlSanitizerService();
        var input = "<img src=\"x\" onerror=\"alert(1)\" />";

        // Act
        var result = service.Sanitize(input);

        // Assert
        result.Should().NotContain("onerror");
        result.Should().NotContain("alert");
        result.Should().Contain("<img src=\"x\">");
    }

    [Fact]
    public void Sanitize_WithMarkdownCodeBlockContainingAngleBrackets_DoesNotStripAngleBrackets()
    {
        // Arrange
        var service = new HtmlSanitizerService();
        var input = "Here is some code:\n\n```csharp\nif (x < y && y > z) { Console.WriteLine(\"test\"); }\n```";

        // Act
        var result = service.Sanitize(input);

        // Assert
        result.Should().Contain("&lt;");
        result.Should().Contain("&gt;");
        result.Should().NotContain("<script>");
    }
}