// Generated, do not edit. sha256:d90f8fe12862c6daa6656fef5bf8ba13b2a3cb9d3b9cb9d68c08cde20d6f7420
import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import { esc } from '../../client/ui/escape.js';

describe('esc', () => {
  it('escapes the five characters that can make HTML structure', () => {
    assert.equal(esc('&'), '&');
    assert.equal(esc('<'), '&lt;');
    assert.equal(esc('>'), '&gt;');
    assert.equal(esc('"'), '&quot;');
    assert.equal(esc("'"), '&#39;');
  });

  it('a script payload no longer becomes a tag', () => {
    assert.equal(esc('<img src=x onerror="alert(1)">'), '&lt;img src=x onerror=&quot;alert(1)&quot;&gt;');
  });

  it('does not break out of a quoted attribute value', () => {
    const html = `<div title="${esc('" onmouseover="alert(1)')}"></div>`;
    assert.equal(html, '<div title="&quot; onmouseover=&quot;alert(1)"></div>');
    assert.equal(html.split('"').length - 1, 2, 'only the two intended quotes');
  });

  it('escapes & first, so no double entities appear', () => {
    assert.equal(esc('<'), '&lt;');
    assert.equal(esc('&lt;'), '&amp;lt;');
  });

  it('gives empty text for null and undefined, and keeps 0 and false', () => {
    assert.equal(esc(null), '');
    assert.equal(esc(undefined), '');
    assert.equal(esc(0), '0');
    assert.equal(esc(false), 'false');
  });

  it('leaves ordinary text alone', () => {
    assert.equal(esc('Rekening Café Spaar (2019)'), 'Rekening Café Spaar (2019)');
  });
});