From 863950eb256691b74f7b3c786e8dc5006705a10e Mon Sep 17 00:00:00 2001
From: Claude <claude@anthropic.com>
Date: Wed, 24 Jun 2026 23:50:44 -0400
Subject: [PATCH] =?UTF-8?q?test(ui):=20React=20parity=20=E2=80=94=20danger?=
 =?UTF-8?q?ouslySetInnerHTML=20/=20RawHTML=20in=20SSR?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ports React's ReactDOMServerIntegrationElements dangerouslySetInnerHTML behavior,
adapted to GWC's html.RawHTML (renders raw markup but sanitizes by default — a
safety improvement over React's raw injection):
- safe markup is preserved
- <script>, javascript: hrefs, and on*= handlers are stripped (text kept)
- html.RawHTMLUnsafe renders the markup verbatim

All pass; no GWC bug. No version bump.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/REACT_TEST_PARITY.md |  1 +
 ui/raw_html_ssr_test.go   | 50 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 ui/raw_html_ssr_test.go

diff --git a/docs/REACT_TEST_PARITY.md b/docs/REACT_TEST_PARITY.md
index 95034a79..7176286d 100644
--- a/docs/REACT_TEST_PARITY.md
+++ b/docs/REACT_TEST_PARITY.md
@@ -40,6 +40,7 @@ re-renders/effects are observable inline. SSR behavior is tested via
 | ReactDOMServerIntegrationUntrustedURL | javascript: URL sanitization | ✅ | ui/url_sanitization_test.go (+ found v3.4.7) |
 | ReactDOMServerIntegrationAttributes | attr boolean/nil/numeric/escaping | ✅ | ui/attribute_serialization_test.go |
 | ReactDOMServerIntegrationElements | void elements, text escaping | ✅ | ui/void_element_test.go, ui/text_escaping_test.go |
+| ReactDOMServerIntegrationElements (dangerouslySetInnerHTML) | raw HTML in SSR | ✅ | ui/raw_html_ssr_test.go — html.RawHTML renders raw but sanitizes (script/js-url/on*= stripped); RawHTMLUnsafe verbatim |
 | ReactDOMServerIntegrationBasic | basic SSR render, nested components, nil | ✅ | ui/ssr_components_test.go |
 | ReactDOMServerIntegrationFragment | fragment SSR | ✅ | ui/ssr_components_test.go (component->fragment hoist) |
 | ReactDOMServerIntegrationSpecialTypes | numbers/bools/null children | 🚫 | Go static typing (ui.Node children) |
diff --git a/ui/raw_html_ssr_test.go b/ui/raw_html_ssr_test.go
new file mode 100644
index 00000000..b6ade48c
--- /dev/null
+++ b/ui/raw_html_ssr_test.go
@@ -0,0 +1,50 @@
+//go:build !js || !wasm
+
+package ui_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/monstercameron/GoWebComponents/html"
+	"github.com/monstercameron/GoWebComponents/ui"
+)
+
+// Ported from React's ReactDOMServerIntegrationElements dangerouslySetInnerHTML
+// tests, adapted to GWC's html.RawHTML — which renders raw markup but sanitizes
+// it by default (a safety improvement over React's raw injection). html.RawHTMLUnsafe
+// renders the markup verbatim.
+func TestRawHTMLSSR(t *testing.T) {
+	render := func(parseNodes []ui.Node) string {
+		parseOut, parseErr := ui.RenderToString(html.Div(html.Props{}, parseNodes...))
+		if parseErr != nil {
+			t.Fatalf("render error: %v", parseErr)
+		}
+		return parseOut
+	}
+
+	// Safe markup is preserved.
+	if parseGot := render(html.RawHTML("<b>bold</b>")); parseGot != "<div><b>bold</b></div>" {
+		t.Errorf("safe RawHTML = %q, want <div><b>bold</b></div>", parseGot)
+	}
+
+	// A <script> is sanitized out; surrounding text is kept.
+	if parseGot := render(html.RawHTML("<script>alert(1)</script>keep")); strings.Contains(parseGot, "<script") || !strings.Contains(parseGot, "keep") {
+		t.Errorf("RawHTML did not sanitize <script>: %q", parseGot)
+	}
+
+	// A javascript: href is stripped by the sanitizer.
+	if parseGot := render(html.RawHTML(`<a href="javascript:alert(1)">x</a>`)); strings.Contains(strings.ToLower(parseGot), "javascript:") {
+		t.Errorf("RawHTML did not strip javascript: href: %q", parseGot)
+	}
+
+	// An on*= handler is stripped.
+	if parseGot := render(html.RawHTML(`<img src=x onerror="alert(1)">`)); strings.Contains(strings.ToLower(parseGot), "onerror") {
+		t.Errorf("RawHTML did not strip on*= handler: %q", parseGot)
+	}
+
+	// RawHTMLUnsafe renders verbatim (no sanitization).
+	if parseGot := render(html.RawHTMLUnsafe("<b>raw</b>")); parseGot != "<div><b>raw</b></div>" {
+		t.Errorf("RawHTMLUnsafe = %q, want <div><b>raw</b></div>", parseGot)
+	}
+}