; unwrapping the tag would # show it as a stray line above the body. Hidden preheaders keep their style. html = ( "<html><head><title>mailer

"""HTML sanitization (SPEC §6.4, §10.4, I-8).""" from __future__ import annotations import uuid from app.indexer.sanitize import sanitize_html MID = uuid.uuid4() def test_scripts_and_handlers_are_removed() -> None: html = '

' result = sanitize_html(html, MID) assert " None: # Newsletters put "mailer" or the subject in ; unwrapping the tag would # show it as a stray line above the body. Hidden preheaders keep their style. html = ( "<html><head><title>mailer" '

' ) result = sanitize_html(html, MID) assert "mailer" not in result.html assert '' in result.html assert "

" in result.html def test_remote_image_is_blocked_and_flagged() -> None: html = '

see this

' result = sanitize_html(html, MID) assert result.has_remote_images assert "tracker.example" not in result.html def test_cid_image_is_rewritten_to_endpoint() -> None: html = '

' result = sanitize_html(html, MID) assert f"/api/messages/{MID}/cid/logo123" in result.html assert not result.has_remote_images def test_data_image_is_preserved() -> None: html = '

' result = sanitize_html(html, MID) assert "data:image/png" in result.html assert not result.has_remote_images def test_safe_links_survive_with_rel() -> None: html = 'link' result = sanitize_html(html, MID) assert "https://example.com" in result.html assert "javascript:" not in result.html.lower() def test_javascript_uri_is_stripped() -> None: html = 'x' result = sanitize_html(html, MID) assert "javascript:" not in result.html.lower() def test_sanitizer_version_reported() -> None: result = sanitize_html("

", MID) assert result.sanitizer_v >= 1 def test_style_block_and_classes_are_kept() -> None: # Mailers (e.g. Fastmail invites) put layout in a ' result = sanitize_html(html, MID) assert " None: html = '

' result = sanitize_html(html, MID) assert "expression(" not in result.html.lower() # the block is nuked but the element/class survive assert 'class="x"' in result.html def test_style_block_import_and_url_stripped_when_remote_blocked() -> None: html = "" result = sanitize_html(html, MID) assert "@import" not in result.html.lower() assert "evil" not in result.html.lower() assert result.has_remote_images def test_script_content_still_stripped_with_style_allowed() -> None: html = "" result = sanitize_html(html, MID) assert "alert(1)" not in result.html assert ".a{color:red}" in result.html