using Xunit; using FluentAssertions; using MimeKit; using Wino.Core.Domain.Models.MailItem; namespace Wino.Core.Tests.Models; public class HtmlPreviewVisitorTests { [Fact] public void HtmlPreviewVisitor_Should_Remove_Blocked_Tags_And_Event_Attributes() { // Arrange var html = """

hello

"""; var message = new MimeMessage(); message.Body = new TextPart("html") { Text = html }; var visitor = new HtmlPreviewVisitor(Path.GetTempPath()); // Act message.Accept(visitor); var output = visitor.HtmlBody; // Assert output.Should().NotContain(" safe bad """; var message = new MimeMessage(); message.Body = new TextPart("html") { Text = html }; var visitor = new HtmlPreviewVisitor(Path.GetTempPath()); // Act message.Accept(visitor); var output = visitor.HtmlBody; // Assert output.Should().Contain("id=\"safe-link\" href=\"https://contoso.com/path\"", "http/https links should be preserved"); output.Should().Contain("id=\"js-link\"", "the element should remain"); output.Should().NotContain("href=\"javascript:", "javascript URLs must be removed"); output.Should().Contain("id=\"allowed\" src=\"data:image/png;base64", "safe image data URLs should be preserved"); output.Should().NotContain("id=\"svg-script\" src=\"data:text/html", "non-image data URLs should be removed"); } }