font-tools/tests/core/preview.test.ts

import { describe, expect, it } from "vitest";
import { previewDocument } from "../../src/core/preview";

describe("sandbox preview document", () => {
  it("escapes text and allows no script capability", () => {
    const html = previewDocument(
      "blob:http://localhost/fixture",
      '<script>alert("x")</script>',
      42,
      1.2,
      { wght: 550 },
    );
    expect(html).toContain("&lt;script&gt;");
    expect(html).not.toContain('<script>alert("x")</script>');
    expect(html).toContain("default-src 'none'");
    expect(html).toContain("&quot;wght&quot; 550");
  });
});