// sanitize_test.go — SanitizeInlineHTML 单测（安全审计 L7）。
package settings

import "testing"

func TestSanitizeInlineHTML(t *testing.T) {
	cases := []struct {
		name string
		in   string
		want string
	}{
		{"空串", "", ""},
		{"纯文本保留", "欢迎使用文件快传", "欢迎使用文件快传"},
		{"合法链接保留", `<a href="https://example.com">官网</a>`, `<a href="https://example.com">官网</a>`},
		{"相对路径链接", `<a href="/docs">文档</a>`, `<a href="/docs">文档</a>`},
		{"锚点链接", `<a href="#top">顶部</a>`, `<a href="#top">顶部</a>`},
		{"script 整体丢弃", `hello<script>alert(1)</script>world`, "helloworld"},
		{"img 丢弃保留文本", `a<img src=x onerror=alert(1)>b`, "ab"},
		{"javascript href 拒绝", `<a href="javascript:alert(1)">x</a>`, "x"},
		{"data href 拒绝", `<a href="data:text/html,<script>">x</a>`, "x"},
		{"事件属性不透传", `<a href="/x" onclick="evil()">y</a>`, `<a href="/x">y</a>`},
		{"注释丢弃", `a<!-- secret -->b`, "ab"},
		{"未闭合标签丢弃剩余", `ok<script>alert(1)`, "ok"},
		{"iframe 丢弃", `<iframe src="//evil"></iframe>text`, "text"},
		{"样式标签丢弃", `<style>*{}</style>plain`, "plain"},
		{"嵌套危险标签", `<div onclick=e><b>bold</b></div>`, "bold"},
		{"大小写标签", `<A HREF="https://e.com">L</A>`, `<a href="https://e.com">L</a>`},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			if got := SanitizeInlineHTML(tc.in); got != tc.want {
				t.Fatalf("SanitizeInlineHTML(%q) = %q, want %q", tc.in, got, tc.want)
			}
		})
	}
}

func TestSanitizeInlineHTMLNoScriptContent(t *testing.T) {
	// script 内部文本也必须丢弃（不做 HTML 转义输出，避免 alert 字样进入页面 DOM）
	got := SanitizeInlineHTML(`<script>var x = "</b>"; alert(1)</script>fine`)
	if got != "fine" {
		t.Fatalf("script 内容应整体丢弃, got %q", got)
	}
}