Testen dynamischer Inhalts-Bereinigung gegen XSS beim Svelte-Rendering

import { render } from '@testing-library/svelte';
import { expect, test } from 'vitest';
import SecureHTMLRenderer from './SecureHTMLRenderer.svelte';
 
test('strips dangerous inline script tags before injecting dynamic markup', () => {
  const maliciousInput = '<img src="x" onerror="alert(1)" /><script>window.pwned=true</script>';
  
  const { container } = render(SecureHTMLRenderer, {
    props: { rawContent: maliciousInput }
  });
 
  const scriptTag = container.querySelector('script');
  const imgTag = container.querySelector('img');
 
  expect(scriptTag).toBeNull();
  expect(imgTag?.getAttribute('onerror')).toBeNull();
  expect(window.pwned).toBeUndefined();
});