import pytest

from apps.jobs.services.sanitize import sanitize_job_html


@pytest.mark.security
def test_sanitize_removes_script_handlers_forms_and_iframes():
    dirty = (
        '<p onclick="alert(1)">Hallo</p><script>alert(1)</script>'
        '<iframe src="x"></iframe><form><input></form>'
        '<a href="javascript:alert(1)">x</a>'
    )
    clean = sanitize_job_html(dirty)
    assert "script" not in clean.lower()
    assert "onclick" not in clean.lower()
    assert "iframe" not in clean.lower()
    assert "form" not in clean.lower()
    assert "javascript:" not in clean.lower()