package web

import (
	"strings"
	"testing"
)

func TestAModelCardCannotRunOrLoadAnything(t *testing.T) {
	card := "# Qwen\n\nA **small** model.\n\n<script>alert(1)</script>\n\n" +
		"<img src=x onerror=alert(1)>\n\n[click](javascript:alert(1))\n\n" +
		"![benchmark](https://tracker.example/pixel.png)\n\n[license](LICENSE)\n\n" +
		"| a | b |\n|---|---|\n| 1 | 2 |\n"
	got := string(renderCard(card, "https://huggingface.co/Qwen/X/blob/abc/"))

	for _, bad := range []string{"<script", "onerror", "javascript:", "<img"} {
		if strings.Contains(got, bad) {
			t.Errorf("the card rendered %q: %s", bad, got)
		}
	}
	// Shown as a link to the picture, not fetched by the page.
	if !strings.Contains(got, `href="https://tracker.example/pixel.png">[benchmark]</a>`) {
		t.Errorf("an image should become a link: %s", got)
	}
	if !strings.Contains(got, `href="https://huggingface.co/Qwen/X/blob/abc/LICENSE"`) {
		t.Errorf("a relative link should point into the repository: %s", got)
	}
	if !strings.Contains(got, "<strong>small</strong>") || !strings.Contains(got, "<table>") {
		t.Errorf("the markdown should render, tables included: %s", got)
	}
}