import { describe, expect, it } from "vitest"; import { buildExternalLinkRedirectHref } from "@/client/lib/external-link"; import { prepareEmailHtml } from "@/client/lib/email-html"; function parsePreparedHtml(result: ReturnType) { return new DOMParser().parseFromString( `${result.headHtml}${result.html}`, "text/html", ); } describe("prepareEmailHtml", () => { it("sanitizes hostile markup and blocks remote content by default", () => { const result = prepareEmailHtml( ` Remote link Mail Call Unsafe

`, false, ); const document = parsePreparedHtml(result); const remoteLink = document.querySelector("#remote"); const mailtoLink = document.querySelector("#mailto"); const telLink = document.querySelector("#tel"); const unsafeLink = document.querySelector("#unsafe"); const blockedImage = document.querySelector('[data-remote-blocked="image"]'); const inlineImage = document.querySelector("#inline-image"); const srcdocHolder = document.querySelector("#srcdoc-holder"); expect(result.blockedRemoteContent).toBe(true); expect(document.querySelector("script")).toBeNull(); expect(document.querySelector("iframe")).toBeNull(); expect(document.querySelector("svg")).toBeNull(); expect(document.body.hasAttribute("onclick")).toBe(false); expect(document.body.getAttribute("style")).toContain("background-image:none"); expect(document.body.getAttribute("style")).toContain("color: blue"); expect(result.headHtml).toContain("background-image: none"); expect(result.headHtml).not.toContain("https://cdn.example.com/theme.css"); expect(remoteLink?.getAttribute("href")).toBe(buildExternalLinkRedirectHref("https://example.com/path?q=1")); expect(remoteLink?.getAttribute("target")).toBe("_blank"); expect(remoteLink?.getAttribute("rel")).toBe("noopener noreferrer nofollow"); expect(mailtoLink?.getAttribute("href")).toBe("mailto:test@example.com"); expect(telLink?.getAttribute("href")).toBe("tel:+15555550123"); expect(unsafeLink?.hasAttribute("href")).toBe(false); expect(blockedImage?.textContent).toContain("Remote image blocked: Hero image"); expect(inlineImage?.getAttribute("src")).toBe("cid:hero-image"); expect(srcdocHolder?.hasAttribute("srcdoc")).toBe(false); }); it("allows remote content when explicitly enabled while preserving other safety rules", () => { const result = prepareEmailHtml( ` Remote link Unsafe

`, true, ); const document = parsePreparedHtml(result); const remoteLink = document.querySelector("#remote"); const unsafeLink = document.querySelector("#unsafe"); const remoteImage = document.querySelector("#remote-image"); expect(result.blockedRemoteContent).toBe(false); expect(result.headHtml).toContain("https://cdn.example.com/background.png"); expect(remoteImage?.getAttribute("src")).toBe("https://images.example.com/hero.png"); expect(remoteLink?.getAttribute("href")).toBe(buildExternalLinkRedirectHref("https://example.com/path?q=1")); expect(unsafeLink?.hasAttribute("href")).toBe(false); expect(document.querySelector('[data-remote-blocked="image"]')).toBeNull(); }); it("preserves inline resources and does not report blocked remote content when none exists", () => { const result = prepareEmailHtml( ` Inline

Mail Call `, false, ); const document = parsePreparedHtml(result); expect(result.blockedRemoteContent).toBe(false); expect(document.body.getAttribute("dir")).toBe("rtl"); expect(document.body.getAttribute("lang")).toBe("ar"); expect(document.querySelector("#inline-image")?.getAttribute("src")).toBe("data:image/png;base64,abc123"); expect(document.querySelector("#mailto")?.getAttribute("href")).toBe("mailto:test@example.com"); expect(document.querySelector("#tel")?.getAttribute("href")).toBe("tel:+15555550123"); }); });