; unwrapping the tag would # show it as a stray line above the body. Hidden preheaders keep their style. html = ( "<html><head><title>mailer

"""HTML sanitization (SPEC §6.4, §10.4, I-8).""" from __future__ import annotations import uuid import pytest from app.indexer.sanitize import sanitize_html MID = uuid.uuid4() def test_scripts_and_handlers_are_removed() -> None: html = '

' result = sanitize_html(html, MID) assert " None: # Newsletters put "mailer" or the subject in ; unwrapping the tag would # show it as a stray line above the body. Hidden preheaders keep their style. html = ( "<html><head><title>mailer" '

' ) result = sanitize_html(html, MID) assert "mailer" not in result.html assert '' in result.html assert "

" in result.html def test_remote_image_is_blocked_and_flagged() -> None: html = '

see this

' result = sanitize_html(html, MID) assert result.has_remote_images assert "tracker.example" not in result.html def test_cid_image_is_rewritten_to_endpoint() -> None: html = '

' result = sanitize_html(html, MID) assert f"/api/messages/{MID}/cid/logo123" in result.html assert not result.has_remote_images def test_data_image_is_preserved() -> None: html = '

' result = sanitize_html(html, MID) assert "data:image/png" in result.html assert not result.has_remote_images def test_safe_links_survive_with_rel() -> None: html = 'link' result = sanitize_html(html, MID) assert "https://example.com" in result.html assert "javascript:" not in result.html.lower() def test_javascript_uri_is_stripped() -> None: html = 'x' result = sanitize_html(html, MID) assert "javascript:" not in result.html.lower() def test_sanitizer_version_reported() -> None: result = sanitize_html("

", MID) assert result.sanitizer_v >= 1 def test_style_block_and_classes_are_kept() -> None: # Mailers (e.g. Fastmail invites) put layout in a ' result = sanitize_html(html, MID) assert " None: html = '

' result = sanitize_html(html, MID) assert "expression(" not in result.html.lower() # the block is nuked but the element/class survive assert 'class="x"' in result.html def test_style_block_import_and_url_stripped_when_remote_blocked() -> None: html = "" result = sanitize_html(html, MID) assert "@import" not in result.html.lower() assert "evil" not in result.html.lower() assert result.has_remote_images def test_script_content_still_stripped_with_style_allowed() -> None: html = "" result = sanitize_html(html, MID) assert "alert(1)" not in result.html assert ".a{color:red}" in result.html # --- Tracking pixels --------------------------------------------------------------- @pytest.mark.parametrize( "tag", [ '', '', "", '', '

', '

', # Squeezed to a pixel by max-width, its height following. '', '', ], ) def test_tracking_pixels_are_removed_and_counted(tag: str) -> None: html = f"

Hello

{tag}

Bye

" for allow in (False, True): result = sanitize_html(html, MID, allow_remote_images=allow) assert result.trackers_blocked == 1 assert "', '

', '

', '', # Outlook signature logos: sizes in inches, not pixels. '', '', '', '', # Attributes say 1x1, the style draws it full width. '', ], ) def test_real_images_are_kept(tag: str) -> None: result = sanitize_html(f"

{tag}", MID, allow_remote_images=True) assert result.trackers_blocked == 0 assert " None: tag = f'

' result = sanitize_html(f"

{tag}", MID, allow_remote_images=True) assert result.trackers_blocked == 0 css = f'

' assert sanitize_html(css, MID, allow_remote_images=True).trackers_blocked == 0 def test_tracker_blocking_can_be_switched_off() -> None: tag = '' kept = sanitize_html(f"

{tag}", MID, allow_remote_images=True, block_trackers=False) assert kept.trackers_blocked == 0 and "t.example.com/o.gif" in kept.html