sanitizer = new class { use Sanitizer; }; }); it('strips the advisory payload from footer html', function () { $output = $this->sanitizer->sanitizeHtml('

'); expect($output)->not->toContain('onerror') ->and($output)->not->toContain('alert('); }); it('strips script elements and javascript uris', function (string $payload, string $forbidden) { expect($this->sanitizer->sanitizeHtml($payload))->not->toContain($forbidden); })->with([ ['', 'x', 'javascript:'], ['', 'onload'], ['', '', 'onload'], ]); it('keeps legitimate formatting and target blank links intact', function () { $output = $this->sanitizer->sanitizeHtml( '

' ); expect($output)->toContain('

') ->and($output)->toContain('href="https://krayincrm.com"') ->and($output)->toContain('target="_blank"') ->and($output)->toContain('Krayin'); }); it('returns an empty string for null and blank input', function () { expect($this->sanitizer->sanitizeHtml(null))->toBe('') ->and($this->sanitizer->sanitizeHtml(' '))->toBe(''); });