"""Comprehensive XSS protection tests for OAuth callback HTML rendering."""
import pytest
from fastmcp.client.oauth_callback import create_callback_html
from fastmcp.utilities.ui import (
create_detail_box,
create_info_box,
create_page,
create_status_message,
)
def test_ui_create_page_escapes_title():
"""Test that page title is properly escaped."""
xss_title = ""
html = create_page("content", title=xss_title)
assert "<script>alert(1)</script>" in html
assert "" not in html
def test_ui_create_status_message_escapes():
"""Test that status messages are properly escaped."""
xss_message = "
"
html = create_status_message(xss_message)
assert "<img src=x onerror=alert(1)>" in html
assert "" not in html
def test_ui_create_info_box_escapes():
"""Test that info box content is properly escaped."""
xss_content = ""
html = create_info_box(xss_content)
assert "<iframe" in html
assert "