setAccessible(true);
return $method->invoke(null, $svg);
}
public function testRemovesScriptElement(): void
{
$clean = $this->sanitize('');
$this->assertStringNotContainsString('assertStringNotContainsString('alert(1)', $clean);
$this->assertStringContainsString('', $clean);
}
public function testRemovesEventHandlers(): void
{
$clean = $this->sanitize('');
$this->assertStringNotContainsString('onload', $clean);
$this->assertStringNotContainsString('onclick', $clean);
}
public function testRemovesJavascriptLinks(): void
{
$clean = $this->sanitize('');
$this->assertStringNotContainsString('javascript:', $clean);
}
public function testKeepsHarmlessMarkup(): void
{
$svg = '';
$this->assertSame($svg, $this->sanitize($svg));
}
public function testRejectsNonSvgContent(): void
{
$this->expectException(RuntimeException::class);
$this->sanitize('GIF89a');
}
public function testIsLocalOnlyAcceptsUploadPaths(): void
{
$this->assertTrue(\Upload::isLocal('uploads/abc.png'));
$this->assertFalse(\Upload::isLocal('https://example.com/logo.png'));
$this->assertFalse(\Upload::isLocal('uploads/../config.php'));
$this->assertFalse(\Upload::isLocal(''));
}
}