package com.zioinfo.kintex.common.text;

import org.junit.jupiter.api.Test;

import static org.junit.jupiter.api.Assertions.*;

/**
 * CMS 본문 XSS sanitize(N2) 단위테스트 — 위험 요소 제거·허용 서식 보존.
 */
class HtmlSanitizerTest {

    @Test
    void removesScriptTagAndContent() {
        String out = HtmlSanitizer.sanitize("<p>안녕</p><script>alert('xss')</script>");
        assertTrue(out.contains("<p>안녕</p>"));
        assertFalse(out.toLowerCase().contains("<script"));
        assertFalse(out.contains("alert"));
    }

    @Test
    void stripsInlineEventHandlers() {
        String out = HtmlSanitizer.sanitize("<a href=\"/ok\" onclick=\"steal()\">링크</a>");
        assertFalse(out.toLowerCase().contains("onclick"));
        assertFalse(out.contains("steal()"));
        assertTrue(out.contains("링크"));
        assertTrue(out.contains("href=\"/ok\""), "안전한 href 는 보존");
    }

    @Test
    void removesJavascriptSchemeUrls() {
        String out = HtmlSanitizer.sanitize("<a href=\"javascript:alert(1)\">x</a>");
        assertFalse(out.toLowerCase().contains("javascript:"));
        assertTrue(out.contains("x"));
    }

    @Test
    void dropsDisallowedTagsButKeepsText() {
        String out = HtmlSanitizer.sanitize("<marquee>흐름</marquee><iframe src=\"evil\"></iframe>");
        assertFalse(out.toLowerCase().contains("<marquee"));
        assertFalse(out.toLowerCase().contains("<iframe"));
        assertTrue(out.contains("흐름"), "허용되지 않은 태그도 텍스트 내용은 보존");
    }

    @Test
    void keepsAllowedFormattingTags() {
        String in = "<h2>제목</h2><p>본문 <strong>강조</strong> <em>기울임</em></p><ul><li>항목</li></ul>";
        String out = HtmlSanitizer.sanitize(in);
        assertEquals(in, out, "허용 서식 태그는 그대로 유지");
    }

    @Test
    void nullAndBlankPassThrough() {
        assertNull(HtmlSanitizer.sanitize(null));
        assertEquals("", HtmlSanitizer.sanitize(""));
    }
}
