From 860d671985b6f76155079350f51ecf258a49ea6a Mon Sep 17 00:00:00 2001
From: Markus Graf <info@markusgraf.ch>
Date: Sun, 29 Mar 2026 21:24:47 +0200
Subject: [PATCH] test(quick-260329-ton): add failing tests for
 renderInlineMarkdown

- Tests cover plain text, empty string, italic, bold, mixed
- Tests cover XSS escaping and standalone asterisks
---
 src/utils/markdown.test.ts | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 src/utils/markdown.test.ts

diff --git a/src/utils/markdown.test.ts b/src/utils/markdown.test.ts
new file mode 100644
index 0000000..91cdca0
--- /dev/null
+++ b/src/utils/markdown.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { renderInlineMarkdown } from "./markdown";
+
+describe("renderInlineMarkdown", () => {
+	it("returns plain text unchanged", () => {
+		expect(renderInlineMarkdown("hello")).toBe("hello");
+	});
+
+	it("returns empty string unchanged", () => {
+		expect(renderInlineMarkdown("")).toBe("");
+	});
+
+	it("converts single asterisks to <em>", () => {
+		expect(renderInlineMarkdown("press *f*")).toBe("press <em>f</em>");
+	});
+
+	it("converts double asterisks to <strong>", () => {
+		expect(renderInlineMarkdown("very **important**")).toBe(
+			"very <strong>important</strong>",
+		);
+	});
+
+	it("handles both bold and italic in one string", () => {
+		expect(renderInlineMarkdown("**bold** and *italic*")).toBe(
+			"<strong>bold</strong> and <em>italic</em>",
+		);
+	});
+
+	it("escapes HTML special characters before markdown processing (XSS safe)", () => {
+		expect(renderInlineMarkdown('<script>alert(1)</script>')).toBe(
+			"&lt;script&gt;alert(1)&lt;/script&gt;",
+		);
+	});
+
+	it("does NOT wrap standalone asterisks surrounded by spaces", () => {
+		expect(renderInlineMarkdown("2 * 3 * 4")).toBe("2 * 3 * 4");
+	});
+});