feat: unit tests for security/utility functions (isPrivateIP, isTransientError, markdown, escapeHtml)

src/__tests__/html-utils.test.ts

@@ -0,0 +1,18 @@
+import { describe, it, expect } from "vitest";
+import { escapeHtml } from "../utils/html.js";
+
+describe("escapeHtml", () => {
+  it("escapes &", () => expect(escapeHtml("a&b")).toBe("a&b"));
+  it("escapes <", () => expect(escapeHtml("a<b")).toBe("a&lt;b"));
+  it("escapes >", () => expect(escapeHtml("a>b")).toBe("a&gt;b"));
+  it('escapes "', () => expect(escapeHtml('a"b')).toBe("a&quot;b"));
+  it("escapes '", () => expect(escapeHtml("a'b")).toBe("a&#39;b"));
+  it("passes through normal text", () => expect(escapeHtml("hello world")).toBe("hello world"));
+  it("handles empty string", () => expect(escapeHtml("")).toBe(""));
+  it("escapes all special chars together", () => {
+    expect(escapeHtml(`&<>"'`)).toBe("&amp;&lt;&gt;&quot;&#39;");
+  });
+  it("double-escapes already-escaped entities", () => {
+    expect(escapeHtml("&amp;")).toBe("&amp;amp;");
+  });
+});