import tempfile from pathlib import Path from zipfile import ZipFile from django.test import SimpleTestCase from .word_preview import render_word_preview class WordPreviewTests(SimpleTestCase): def test_docx_text_escaped_and_tables(self): with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / 'note.docx' document = b''' <script>alert(1)</script> Tableau ''' with ZipFile(path, 'w') as archive: archive.writestr('word/document.xml', document) html = render_word_preview(path) self.assertIn('<script>', html) self.assertNotIn('