import { sanitizeHtml, sanitizeText, sanitizeUrl } from "../sanitize";

describe("Sanitization Functions", () => {
  describe("sanitizeText", () => {
    it("should remove HTML tags", () => {
      const dirty = "<script>alert('XSS')</script>Hello";
      const clean = sanitizeText(dirty);
      expect(clean).not.toContain("<script>");
      expect(clean).not.toContain("</script>");
    });

    it("should handle null and undefined", () => {
      expect(sanitizeText(null)).toBe("");
      expect(sanitizeText(undefined)).toBe("");
    });

    it("should escape dangerous characters", () => {
      const dirty = "<img src=x onerror=alert('XSS')>";
      const clean = sanitizeText(dirty);
      expect(clean).not.toContain("<img");
    });
  });

  describe("sanitizeUrl", () => {
    it("should block javascript: URLs", () => {
      const dirty = "javascript:alert('XSS')";
      const clean = sanitizeUrl(dirty);
      expect(clean).toBe("");
    });

    it("should block data: URLs", () => {
      const dirty = "data:text/html,<script>alert('XSS')</script>";
      const clean = sanitizeUrl(dirty);
      expect(clean).toBe("");
    });

    it("should allow safe URLs", () => {
      const safe = "https://example.com";
      const clean = sanitizeUrl(safe);
      expect(clean).toBeTruthy();
    });

    it("should handle null and undefined", () => {
      expect(sanitizeUrl(null)).toBe("");
      expect(sanitizeUrl(undefined)).toBe("");
    });
  });

  describe("sanitizeHtml", () => {
    it("should remove script tags", () => {
      const dirty = "<p>Hello</p><script>alert('XSS')</script>";
      const clean = sanitizeHtml(dirty);
      expect(clean).not.toContain("<script>");
    });

    it("should handle null and undefined", () => {
      expect(sanitizeHtml(null)).toBe("");
      expect(sanitizeHtml(undefined)).toBe("");
    });
  });
});