Add tests via JSDOM-global

tests/html/safeHTML.test.js

@@ -0,0 +1,50 @@
+/* eslint-disable max-lines */
+
+require('jsdom-global')();
+
+import { safeHTML } from '../../client/homebrew/brewRenderer/safeHTML';
+
+test('Javascript via href', function() {
+	const source = `<a href="javascript:alert('This is a JavaScript injection via href attribute')">Click me</a>`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<a>Click me</a>');
+});
+
+test('Javascript via src', function() {
+	const source = `<img src="javascript:alert('This is a JavaScript injection via src attribute')">`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<img>');
+});
+
+test('Javascript via action', function() {
+	const source = `<form action="javascript:alert('This is a JavaScript injection via action attribute')">\n<input type="submit" value="Submit">\n</form>`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<form>\n<input type=\"submit\" value=\"Submit\">\n</form>');
+});
+
+test('Javascript via inline event handler - onClick', function() {
+	const source = `<div style="background-color: red; color: white; width: 100px; height: 100px;" onclick="alert('This is a JavaScript injection via inline event handler')">\nClick me\n</div>`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<div style=\"background-color: red; color: white; width: 100px; height: 100px;\">\nClick me\n</div>');
+});
+
+test('Javascript via inline event handler - onMouseOver', function() {
+	const source = `<div onmouseover="alert('This is a JavaScript injection via inline event handler')">Hover over me</div>`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<div>Hover over me</div>');
+});
+
+test('Javascript via data attribute', function() {
+	const source = `<div data-code="javascript:alert('This is a JavaScript injection via data attribute')">Test</div>`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<div>Test</div>');
+});
+
+test('Javascript via event delegation', function() {
+	const source = `<div id="parent"><button id="child">Click me</button></div><script>document.getElementById('parent').addEventListener('click', function(event) {if (event.target.id === 'child') {console.log('This is JavaScript executed via event delegation');}});</script>`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<div id="parent"><button id="child">Click me</button></div>');
+});
+
+
+