test suit updated

test/sanitize.test.js

@@ -0,0 +1,72 @@
+const { escapeSvg, safeColor } = require('../src/lib/sanitize');
+
+describe('sanitize', () => {
+
+  describe('escapeSvg', () => {
+    it('should escape < and >', () => {
+      expect(escapeSvg('<script>')).toBe('&lt;script&gt;');
+    });
+
+    it('should escape &', () => {
+      expect(escapeSvg('A & B')).toBe('A &amp; B');
+    });
+
+    it('should escape double quotes', () => {
+      expect(escapeSvg('"hello"')).toBe('&quot;hello&quot;');
+    });
+
+    it('should escape single quotes', () => {
+      expect(escapeSvg("it's")).toBe('it&#x27;s');
+    });
+
+    it('should escape combined special characters', () => {
+      expect(escapeSvg('<img src="x" onerror=\'alert(1)\'>')).toBe(
+        '&lt;img src=&quot;x&quot; onerror=&#x27;alert(1)&#x27;&gt;'
+      );
+    });
+
+    it('should pass through normal text unchanged', () => {
+      expect(escapeSvg('Hello World')).toBe('Hello World');
+      expect(escapeSvg('test-123')).toBe('test-123');
+    });
+
+    it('should handle numbers by converting to string', () => {
+      expect(escapeSvg(42)).toBe('42');
+    });
+
+    it('should handle empty string', () => {
+      expect(escapeSvg('')).toBe('');
+    });
+  });
+
+  describe('safeColor', () => {
+    it('should accept hex colors', () => {
+      expect(safeColor('#fff')).toBe('#fff');
+      expect(safeColor('#FF0000')).toBe('#FF0000');
+      expect(safeColor('#12345678')).toBe('#12345678');
+    });
+
+    it('should accept named colors', () => {
+      expect(safeColor('red')).toBe('red');
+      expect(safeColor('blue')).toBe('blue');
+      expect(safeColor('none')).toBe('none');
+      expect(safeColor('transparent')).toBe('transparent');
+    });
+
+    it('should return fallback for invalid colors', () => {
+      expect(safeColor('javascript:alert(1)')).toBe('#000000');
+      expect(safeColor('rgb(255,0,0)')).toBe('#000000');
+      expect(safeColor('url(evil)')).toBe('#000000');
+    });
+
+    it('should use custom fallback for non-alphabetic invalid values', () => {
+      expect(safeColor('rgb(255,0,0)', '#fff')).toBe('#fff');
+      expect(safeColor('url(evil)', 'none')).toBe('none');
+    });
+
+    it('should return default fallback (#000000) when not specified', () => {
+      expect(safeColor('')).toBe('#000000');
+      expect(safeColor('999')).toBe('#000000');
+    });
+  });
+});