1 files changed, 29 insertions, 0 deletions
diff --git a/internal/markdown/render_test.go b/internal/markdown/render_test.go
new file mode 100644
index 0000000..7240afc
--- /dev/null
+++ b/internal/markdown/render_test.go
@@ -0,0 +1,29 @@
+package markdown
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRenderSanitizes(t *testing.T) {
+	out := Render("# Hi\n\n**bold** <script>alert(1)</script> <a href=\"javascript:alert(1)\">x</a> <img src=\"/media/abc\" onerror=\"x()\">")
+	for _, bad := range []string{"<script", "javascript:", "onerror"} {
+		if strings.Contains(out, bad) {
+			t.Errorf("output contains %q: %s", bad, out)
+		}
+	}
+	for _, good := range []string{"<h1", "<strong>bold</strong>", `<img src="/media/abc"`} {
+		if !strings.Contains(out, good) {
+			t.Errorf("output missing %q: %s", good, out)
+		}
+	}
+}
+
+func TestRenderGFM(t *testing.T) {
+	out := Render("| a | b |\n|---|---|\n| 1 | 2 |\n\nline one\nline two\n\nhttps://example.org")
+	for _, want := range []string{"<table>", "<br>", `<a href="https://example.org"`} {
+		if !strings.Contains(out, want) {
+			t.Errorf("output missing %q: %s", want, out)
+		}
+	}
+}