krz/hutch

 1import Foundation
 2import Testing
 3@testable import Hutch
 4
 5struct ReadmeViewTests {
 6
 7    @Test
 8    func sanitizedReadmeLinkURLStringRejectsUnexpectedSchemes() {
 9        #expect(sanitizedReadmeLinkURLString("javascript:alert(1)") == nil)
10        #expect(sanitizedReadmeLinkURLString("file:///tmp/readme") == nil)
11        #expect(sanitizedReadmeLinkURLString("data:text/html;base64,SGVsbG8=") == nil)
12    }
13
14    @Test
15    func processInlineDropsUnsafeMarkdownLinks() {
16        let rendered = processInline("[click me](javascript:alert)")
17
18        #expect(rendered == "click me")
19        #expect(!rendered.contains("href="))
20        #expect(!rendered.contains("javascript:"))
21    }
22
23    @Test
24    func sanitizedReadmeLinkURLStringAllowsExpectedDestinations() {
25        #expect(sanitizedReadmeLinkURLString("https://example.com/docs?q=1") == "https://example.com/docs?q=1")
26        #expect(sanitizedReadmeLinkURLString("mailto:test@example.com") == "mailto:test@example.com")
27        #expect(sanitizedReadmeLinkURLString("#readme") == "#readme")
28    }
29}