test: link sanitization tests

Author: hejsztynx

…eb/__tests__/mentionSanitization.test.ts src/web/__tests__/sanitization.test.tssrc/web/__tests__/mentionSanitization.test.ts renamed to src/web/__tests__/sanitization.test.ts src/web/__tests__/mentionSanitization.test.ts renamed to src/web/__tests__/sanitization.test.ts

@@ -82,7 +82,7 @@ describe('checkMentionAttributes', () => {
   });
 });
 
-describe('sanitizeHtml', () => {
+describe('sanitizeHtmlMention', () => {
   it('keeps <mention> tags with text/indicator/data-* attributes', () => {
     const out = sanitizeHtml(
       '<mention text="Joe" indicator="@" data-user-id="42">@Joe</mention>'
@@ -98,3 +98,16 @@ describe('sanitizeHtml', () => {
     ).not.toContain('onclick');
   });
 });
+
+describe('sanitizeLinkAttributes', () => {
+  it('strips javascript: URLs from links', () => {
+    const out = sanitizeHtml('<a href="javascript:alert(1)">x</a>');
+    // eslint-disable-next-line no-script-url
+    expect(out).not.toContain('javascript:');
+  });
+
+  it('strips unknown protocol URLs from links', () => {
+    const out = sanitizeHtml('<a href="custom://link">x</a>');
+    expect(out).not.toContain('custom');
+  });
+});