test: collapse conftest fixtures and use real DOMPurify in JS tests

Extract _make_test_client() for shared Flask client seeding. Run
markdown XSS tests against dompurify/marked dev deps (CDN versions)
instead of a regex mock sanitize implementation.

Author: clean6378-max-it

package-lock.json

@@ -8,7 +8,9 @@
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^3.2.4",
+    "dompurify": "^3.2.7",
     "jsdom": "^26.1.0",
+    "marked": "^12.0.1",
     "vitest": "^3.2.4"
   }
 }

package.json

@@ -1,4 +1,6 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import DOMPurify from 'dompurify';
+import { marked } from 'marked';
 import { cleanContent, renderMarkdown } from './markdown.js';
 
 const _origMarked = globalThis.marked;
@@ -17,24 +19,24 @@ describe('cleanContent', () => {
 
 describe('renderMarkdown', () => {
     beforeEach(() => {
-        globalThis.marked = {
-            parse: vi.fn((text) => `<p>${text}</p>`),
-        };
-        globalThis.DOMPurify = {
-            sanitize: vi.fn((html) => html.replace(/<script[\s\S]*?<\/script>/gi, '')),
-        };
+        globalThis.marked = marked;
+        globalThis.DOMPurify = DOMPurify;
     });
 
     afterEach(() => {
-        vi.restoreAllMocks();
         globalThis.marked = _origMarked;
         globalThis.DOMPurify = _origDOMPurify;
     });
 
     it('sanitizes script tags from parsed output', () => {
-        globalThis.marked.parse.mockReturnValue('<p>ok</p><script>alert(1)</script>');
-        const html = renderMarkdown('# Hello');
+        const html = renderMarkdown('# Hello\n\n<script>alert(1)</script>');
         expect(html).not.toContain('<script');
+        expect(html).not.toMatch(/alert\s*\(/);
+    });
+
+    it('strips event handlers from parsed output', () => {
+        const html = renderMarkdown('<img src=x onerror=alert(1)>');
+        expect(html).not.toMatch(/onerror/i);
     });
 
     it('falls back to inline code when marked is unavailable', () => {

static/js/shared/markdown.test.js

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import shutil
+from collections.abc import Mapping
 from pathlib import Path
 
 import pytest
@@ -12,43 +13,45 @@
 FIXTURES = Path(__file__).parent / "fixtures"
 
 
-@pytest.fixture
-def client(tmp_path):
-    """Flask test client with two seeded sessions in 'test-project'."""
-    project_dir = tmp_path / "test-project"
-    project_dir.mkdir(parents=True)
-    shutil.copy(FIXTURES / "session_minimal.jsonl", project_dir / "session_abc123.jsonl")
-    shutil.copy(FIXTURES / "session_with_tools.jsonl", project_dir / "session_def456.jsonl")
+def _make_test_client(tmp_path, session_files: Mapping[str, str] | None = None):
+    """Build a Flask test client, optionally seeding session JSONL files under test-project."""
+    if session_files:
+        project_dir = tmp_path / "test-project"
+        project_dir.mkdir(parents=True)
+        for dest_name, fixture_name in session_files.items():
+            shutil.copy(FIXTURES / fixture_name, project_dir / dest_name)
     app = create_app(base_dir=str(tmp_path))
     app.config["TESTING"] = True
     return app.test_client()
 
 
+@pytest.fixture
+def client(tmp_path):
+    """Flask test client with two seeded sessions in 'test-project'."""
+    return _make_test_client(
+        tmp_path,
+        {
+            "session_abc123.jsonl": "session_minimal.jsonl",
+            "session_def456.jsonl": "session_with_tools.jsonl",
+        },
+    )
+
+
 @pytest.fixture
 def client_single(tmp_path):
     """Flask test client with one seeded session — for search/limit tests."""
-    project_dir = tmp_path / "test-project"
-    project_dir.mkdir(parents=True)
-    shutil.copy(FIXTURES / "session_minimal.jsonl", project_dir / "session_abc123.jsonl")
-    app = create_app(base_dir=str(tmp_path))
-    app.config["TESTING"] = True
-    return app.test_client()
+    return _make_test_client(tmp_path, {"session_abc123.jsonl": "session_minimal.jsonl"})
 
 
 @pytest.fixture
 def client_empty(tmp_path):
     """Flask test client with an empty projects directory."""
-    app = create_app(base_dir=str(tmp_path))
-    app.config["TESTING"] = True
-    return app.test_client()
+    return _make_test_client(tmp_path)
 
 
 @pytest.fixture
 def client_thinking(tmp_path):
     """Flask test client with a session containing thinking content blocks."""
-    project_dir = tmp_path / "test-project"
-    project_dir.mkdir(parents=True)
-    shutil.copy(FIXTURES / "session_with_thinking.jsonl", project_dir / "session_think001.jsonl")
-    app = create_app(base_dir=str(tmp_path))
-    app.config["TESTING"] = True
-    return app.test_client()
+    return _make_test_client(
+        tmp_path, {"session_think001.jsonl": "session_with_thinking.jsonl"}
+    )