from goodnews.markup import render_reply_html as r


def test_escapes_before_formatting():
    out = r("<script>alert(1)</script> and **bold**")
    assert "<script>" not in out and "&lt;script&gt;" in out
    assert "<strong>bold</strong>" in out


def test_bullets_and_heading_and_paragraphs():
    assert r("- one\n- two") == "<ul><li>one</li><li>two</li></ul>"
    assert r("## Update") == "<h4>Update</h4>"
    assert r("a\nb\n\nc") == "<p>a<br>b</p><p>c</p>"


def test_no_links_or_attrs_pass_through():
    out = r('[click](http://x) <a href="x" onclick="y">hi</a>')
    assert "<a" not in out      # no anchor tag produced or passed through (escaped to &lt;a)
    assert "[click]" in out     # markdown links unsupported → left as literal text


def test_empty():
    assert r("   ") == "" and r(None) == ""