@transferwise/components 46.155.1 → 46.156.0

package/src/Markup/utils/parseMarkup.test.ts

@@ -0,0 +1,706 @@
+import {
+  parseMarkup,
+  MAX_NESTING_DEPTH,
+  MAX_INPUT_LENGTH,
+  MAX_ACCESSIBILITY_LABEL_LENGTH,
+} from './parseMarkup';
+
+describe('parseMarkup', () => {
+  it('returns a single text node for plain text', () => {
+    expect(parseMarkup('hello world')).toEqual([{ type: 'text', content: 'hello world' }]);
+  });
+
+  it('returns empty array for empty string', () => {
+    expect(parseMarkup('')).toEqual([]);
+  });
+
+  it('splits text on newlines', () => {
+    expect(parseMarkup('line one\nline two')).toEqual([
+      { type: 'text', content: 'line one' },
+      { type: 'newline' },
+      { type: 'text', content: 'line two' },
+    ]);
+  });
+
+  it('preserves literal backslash-n as text (not treated as newline)', () => {
+    expect(parseMarkup('line one\\nline two')).toEqual([
+      { type: 'text', content: 'line one\\nline two' },
+    ]);
+  });
+
+  describe('link tags', () => {
+    it('parses <link> with href attribute (double quotes)', () => {
+      expect(parseMarkup('go to <link href="/settings">settings</link> page')).toEqual([
+        { type: 'text', content: 'go to ' },
+        { type: 'link', href: '/settings', children: [{ type: 'text', content: 'settings' }] },
+        { type: 'text', content: ' page' },
+      ]);
+    });
+
+    it('parses <link> with href attribute (single quotes)', () => {
+      expect(parseMarkup("<link href='/path'>click</link>")).toEqual([
+        { type: 'link', href: '/path', children: [{ type: 'text', content: 'click' }] },
+      ]);
+    });
+
+    it('parses <link> with action attribute', () => {
+      expect(parseMarkup('<link action="save">Save now</link>')).toEqual([
+        {
+          type: 'link',
+          action: 'save',
+          children: [{ type: 'text', content: 'Save now' }],
+        },
+      ]);
+    });
+
+    it('parses <link> with href and target attributes', () => {
+      expect(parseMarkup('<link href="https://example.com" target="_blank">visit</link>')).toEqual([
+        {
+          type: 'link',
+          href: 'https://example.com',
+          target: '_blank',
+          children: [{ type: 'text', content: 'visit' }],
+        },
+      ]);
+    });
+
+    it('parses <a> as an alias for link', () => {
+      expect(parseMarkup('<a href="/page">click</a>')).toEqual([
+        { type: 'link', href: '/page', children: [{ type: 'text', content: 'click' }] },
+      ]);
+    });
+  });
+
+  describe('nesting', () => {
+    it('supports emphasis inside link', () => {
+      expect(parseMarkup('<link href="/x"><important>bold link</important></link>')).toEqual([
+        {
+          type: 'link',
+          href: '/x',
+          children: [
+            {
+              type: 'important',
+              children: [{ type: 'text', content: 'bold link' }],
+            },
+          ],
+        },
+      ]);
+    });
+
+    it('supports link inside emphasis', () => {
+      expect(
+        parseMarkup('<important>Read the <link href="/terms">terms</link> carefully</important>'),
+      ).toEqual([
+        {
+          type: 'important',
+          children: [
+            { type: 'text', content: 'Read the ' },
+            {
+              type: 'link',
+              href: '/terms',
+              children: [{ type: 'text', content: 'terms' }],
+            },
+            { type: 'text', content: ' carefully' },
+          ],
+        },
+      ]);
+    });
+
+    it('supports multi-level nesting', () => {
+      expect(
+        parseMarkup('<positive><important><link href="/x">deep</link></important></positive>'),
+      ).toEqual([
+        {
+          type: 'positive',
+          children: [
+            {
+              type: 'important',
+              children: [
+                {
+                  type: 'link',
+                  href: '/x',
+                  children: [{ type: 'text', content: 'deep' }],
+                },
+              ],
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  describe('malformed input', () => {
+    it('treats unclosed tags as literal text', () => {
+      expect(parseMarkup('<important>unclosed')).toEqual([
+        { type: 'text', content: '<important>' },
+        { type: 'text', content: 'unclosed' },
+      ]);
+    });
+
+    it('treats unrecognized tags as literal text', () => {
+      expect(parseMarkup('<script>alert("xss")</script>')).toEqual([
+        { type: 'text', content: '<script>alert("xss")</script>' },
+      ]);
+    });
+
+    it('treats mismatched close tag as literal text', () => {
+      expect(parseMarkup('<important>text</positive>')).toEqual([
+        { type: 'text', content: '<important>' },
+        { type: 'text', content: 'text' },
+        { type: 'text', content: '</positive>' },
+      ]);
+    });
+
+    it('ignores unknown attributes on link tags', () => {
+      expect(parseMarkup('<link href="/x" onclick="evil()">text</link>')).toEqual([
+        { type: 'link', href: '/x', children: [{ type: 'text', content: 'text' }] },
+      ]);
+    });
+
+    it('does not match tags that are prefixes of longer words', () => {
+      expect(parseMarkup('<stronger>text</stronger>')).toEqual([
+        { type: 'text', content: '<stronger>text</stronger>' },
+      ]);
+    });
+
+    it('does not match <paragraphing> as <paragraph>', () => {
+      expect(parseMarkup('<paragraphing>text</paragraphing>')).toEqual([
+        { type: 'text', content: '<paragraphing>text</paragraphing>' },
+      ]);
+    });
+  });
+
+  describe('emphasis tags', () => {
+    it('parses <important> tag', () => {
+      expect(parseMarkup('this is <important>critical</important> info')).toEqual([
+        { type: 'text', content: 'this is ' },
+        { type: 'important', children: [{ type: 'text', content: 'critical' }] },
+        { type: 'text', content: ' info' },
+      ]);
+    });
+
+    it('parses all emphasis tag variants', () => {
+      const result = parseMarkup('<positive>good</positive> <negative>bad</negative>');
+      expect(result).toEqual([
+        { type: 'positive', children: [{ type: 'text', content: 'good' }] },
+        { type: 'text', content: ' ' },
+        { type: 'negative', children: [{ type: 'text', content: 'bad' }] },
+      ]);
+    });
+  });
+
+  describe('strong and strikethrough tags', () => {
+    it('parses <strong> tag', () => {
+      expect(parseMarkup('this is <strong>bold</strong> text')).toEqual([
+        { type: 'text', content: 'this is ' },
+        { type: 'strong', children: [{ type: 'text', content: 'bold' }] },
+        { type: 'text', content: ' text' },
+      ]);
+    });
+
+    it('parses <strikethrough> tag', () => {
+      expect(parseMarkup('this is <strikethrough>removed</strikethrough> text')).toEqual([
+        { type: 'text', content: 'this is ' },
+        { type: 'strikethrough', children: [{ type: 'text', content: 'removed' }] },
+        { type: 'text', content: ' text' },
+      ]);
+    });
+  });
+
+  describe('paragraph tags', () => {
+    it('parses <paragraph> tag', () => {
+      expect(parseMarkup('<paragraph>A full paragraph.</paragraph>')).toEqual([
+        { type: 'paragraph', children: [{ type: 'text', content: 'A full paragraph.' }] },
+      ]);
+    });
+
+    it('parses <p> as an alias for paragraph', () => {
+      expect(parseMarkup('<p>Short form.</p>')).toEqual([
+        { type: 'paragraph', children: [{ type: 'text', content: 'Short form.' }] },
+      ]);
+    });
+  });
+
+  describe('accessibilityLabel', () => {
+    it('extracts accessibilityLabel from link tags', () => {
+      expect(
+        parseMarkup('<link href="/settings" accessibilityLabel="Go to settings">settings</link>'),
+      ).toEqual([
+        {
+          type: 'link',
+          href: '/settings',
+          accessibilityLabel: 'Go to settings',
+          children: [{ type: 'text', content: 'settings' }],
+        },
+      ]);
+    });
+
+    it('extracts accessibilityLabel from emphasis tags', () => {
+      expect(parseMarkup('<important accessibilityLabel="Notice">critical</important>')).toEqual([
+        {
+          type: 'important',
+          accessibilityLabel: 'Notice',
+          children: [{ type: 'text', content: 'critical' }],
+        },
+      ]);
+    });
+
+    it('extracts accessibilityLabel from strong tags', () => {
+      expect(parseMarkup('<strong accessibilityLabel="Key point">bold</strong>')).toEqual([
+        {
+          type: 'strong',
+          accessibilityLabel: 'Key point',
+          children: [{ type: 'text', content: 'bold' }],
+        },
+      ]);
+    });
+
+    it('extracts accessibilityLabel from strikethrough tags', () => {
+      expect(
+        parseMarkup('<strikethrough accessibilityLabel="Was 50 GBP">£50</strikethrough>'),
+      ).toEqual([
+        {
+          type: 'strikethrough',
+          accessibilityLabel: 'Was 50 GBP',
+          children: [{ type: 'text', content: '£50' }],
+        },
+      ]);
+    });
+
+    it('does not extract accessibilityLabel from paragraph tags', () => {
+      expect(parseMarkup('<paragraph accessibilityLabel="ignored">text</paragraph>')).toEqual([
+        { type: 'paragraph', children: [{ type: 'text', content: 'text' }] },
+      ]);
+    });
+
+    it('does not include accessibilityLabel key when attribute is absent', () => {
+      const result = parseMarkup('<important>text</important>');
+      expect(result[0]).not.toHaveProperty('accessibilityLabel');
+    });
+  });
+
+  describe('stack overflow via deep nesting (DoS)', () => {
+    it('handles deeply nested tags without crashing', () => {
+      const depth = 10000;
+      const input = `${'<important>'.repeat(depth)}x${'</important>'.repeat(depth)}`;
+      expect(() => parseMarkup(input)).not.toThrow();
+    });
+
+    it('degrades gracefully at excessive depth', () => {
+      const depth = 10000;
+      const input = `${'<important>'.repeat(depth)}x${'</important>'.repeat(depth)}`;
+      const result = parseMarkup(input);
+      expect(result.length).toBeGreaterThan(0);
+    });
+
+    it('respects MAX_NESTING_DEPTH', () => {
+      const depth = MAX_NESTING_DEPTH + 20;
+      const input = `${'<important>'.repeat(depth)}x${'</important>'.repeat(depth)}`;
+      const result = parseMarkup(input);
+      const deepNode = JSON.stringify(result);
+      let nesting = 0;
+      let maxNesting = 0;
+      for (const char of deepNode) {
+        if (char === '{') nesting += 1;
+        if (char === '}') nesting -= 1;
+        maxNesting = Math.max(maxNesting, nesting);
+      }
+      expect(maxNesting).toBeLessThan(MAX_NESTING_DEPTH * 3);
+    });
+  });
+
+  describe('prototype pollution via action attribute', () => {
+    it('does not extract __proto__ as action value', () => {
+      const result = parseMarkup('<link action="__proto__">click</link>');
+      const linkNode = result[0];
+      expect(linkNode).toHaveProperty('type', 'link');
+      expect(linkNode).not.toHaveProperty('action');
+    });
+
+    it('does not extract constructor as action value', () => {
+      const result = parseMarkup('<link action="constructor">click</link>');
+      const linkNode = result[0];
+      expect(linkNode).toHaveProperty('type', 'link');
+      expect(linkNode).not.toHaveProperty('action');
+    });
+
+    it('does not extract toString as action value', () => {
+      const result = parseMarkup('<link action="toString">click</link>');
+      const linkNode = result[0];
+      expect(linkNode).toHaveProperty('type', 'link');
+      expect(linkNode).not.toHaveProperty('action');
+    });
+
+    it('does not extract valueOf as action value', () => {
+      const result = parseMarkup('<link action="valueOf">click</link>');
+      const linkNode = result[0];
+      expect(linkNode).toHaveProperty('type', 'link');
+      expect(linkNode).not.toHaveProperty('action');
+    });
+
+    it('does not extract hasOwnProperty as action value', () => {
+      const result = parseMarkup('<link action="hasOwnProperty">click</link>');
+      const linkNode = result[0];
+      expect(linkNode).toHaveProperty('type', 'link');
+      expect(linkNode).not.toHaveProperty('action');
+    });
+
+    it('allows legitimate action values', () => {
+      const result = parseMarkup('<link action="save">click</link>');
+      const linkNode = result[0] as { type: string; action?: string };
+      expect(linkNode.action).toBe('save');
+    });
+  });
+
+  describe('duplicate attribute injection', () => {
+    it('uses first href value when duplicated', () => {
+      const result = parseMarkup('<link href="/safe" href="javascript:alert(1)">click</link>');
+      const linkNode = result[0] as { type: string; href?: string };
+      expect(linkNode.href).toBe('/safe');
+    });
+
+    it('uses first action value when duplicated', () => {
+      const result = parseMarkup('<link action="safe" action="evil">click</link>');
+      const linkNode = result[0] as { type: string; action?: string };
+      expect(linkNode.action).toBe('safe');
+    });
+
+    it('uses first target value when duplicated', () => {
+      const result = parseMarkup('<link href="/x" target="_blank" target="_top">click</link>');
+      const linkNode = result[0] as { type: string; target?: string };
+      expect(linkNode.target).toBe('_blank');
+    });
+  });
+
+  describe('HTML/script in accessibilityLabel', () => {
+    it('strips HTML from accessibilityLabel', () => {
+      const result = parseMarkup(
+        '<link href="/x" accessibilityLabel="click &lt;here&gt;">text</link>',
+      );
+      const linkNode = result[0] as { type: string; accessibilityLabel?: string };
+      expect(linkNode.accessibilityLabel).not.toContain('<');
+      expect(linkNode.accessibilityLabel).not.toContain('>');
+    });
+
+    it('strips angle brackets from accessibilityLabel (defense-in-depth)', () => {
+      const result = parseMarkup(
+        '<important accessibilityLabel="test<b>bold</b>end">text</important>',
+      );
+      const node = result[0] as { type: string; accessibilityLabel?: string };
+      expect(node.accessibilityLabel).toBe('testbbold/bend');
+      expect(node.accessibilityLabel).not.toContain('<');
+      expect(node.accessibilityLabel).not.toContain('>');
+    });
+
+    it('strips quotes from accessibilityLabel to prevent attribute injection', () => {
+      const result = parseMarkup(
+        '<important accessibilityLabel="x&quot; onfocus=&quot;alert(1)">text</important>',
+      );
+      const node = result[0] as { type: string; accessibilityLabel?: string };
+      if (node.accessibilityLabel) {
+        expect(node.accessibilityLabel).not.toContain('"');
+      }
+    });
+
+    it('preserves safe accessibilityLabel text', () => {
+      const result = parseMarkup(
+        '<important accessibilityLabel="Navigate to settings page">text</important>',
+      );
+      const node = result[0] as { type: string; accessibilityLabel?: string };
+      expect(node.accessibilityLabel).toBe('Navigate to settings page');
+    });
+  });
+
+  describe('unvalidated target attribute', () => {
+    it('allows target="_blank"', () => {
+      const result = parseMarkup('<link href="/x" target="_blank">text</link>');
+      const linkNode = result[0] as { type: string; target?: string };
+      expect(linkNode.target).toBe('_blank');
+    });
+
+    it('allows target="_self"', () => {
+      const result = parseMarkup('<link href="/x" target="_self">text</link>');
+      const linkNode = result[0] as { type: string; target?: string };
+      expect(linkNode.target).toBe('_self');
+    });
+
+    it('blocks target="_top" (iframe breakout)', () => {
+      const result = parseMarkup('<link href="/x" target="_top">text</link>');
+      const linkNode = result[0] as { type: string; target?: string };
+      expect(linkNode).not.toHaveProperty('target');
+    });
+
+    it('blocks target="_parent" (iframe breakout)', () => {
+      const result = parseMarkup('<link href="/x" target="_parent">text</link>');
+      const linkNode = result[0] as { type: string; target?: string };
+      expect(linkNode).not.toHaveProperty('target');
+    });
+
+    it('blocks arbitrary target values', () => {
+      const result = parseMarkup('<link href="/x" target="evil-frame">text</link>');
+      const linkNode = result[0] as { type: string; target?: string };
+      expect(linkNode).not.toHaveProperty('target');
+    });
+  });
+
+  describe('slash as attribute separator bypass', () => {
+    it('does not parse attributes after / separator', () => {
+      const result = parseMarkup('<link/href="/evil">click</link>');
+      const linkNode = result[0] as { type: string; href?: string };
+      expect(linkNode).not.toHaveProperty('href');
+    });
+  });
+
+  describe('control characters in attribute values', () => {
+    it('strips control characters from href values', () => {
+      const result = parseMarkup('<link href="/path\x00evil">text</link>');
+      const linkNode = result[0] as { type: string; href?: string };
+      if (linkNode.href) {
+        expect(linkNode.href).not.toContain('\x00');
+      }
+    });
+
+    it('strips newlines from href values', () => {
+      const result = parseMarkup('<link href="/path\nevil">text</link>');
+      const linkNode = result[0] as { type: string; href?: string };
+      if (linkNode.href) {
+        expect(linkNode.href).not.toContain('\n');
+      }
+    });
+
+    it('strips tabs from href values', () => {
+      const result = parseMarkup('<link href="/path\tevil">text</link>');
+      const linkNode = result[0] as { type: string; href?: string };
+      if (linkNode.href) {
+        expect(linkNode.href).not.toContain('\t');
+      }
+    });
+  });
+
+  describe('mismatched nesting (graceful degradation)', () => {
+    it('handles inner tag closed by outer close tag', () => {
+      const result = parseMarkup('<important><strong>text</important></strong>');
+      expect(result).toBeDefined();
+      expect(result.length).toBeGreaterThan(0);
+    });
+
+    it('handles interleaved open/close tags', () => {
+      const result = parseMarkup('<important><strong>text</important>more</strong>');
+      expect(result).toBeDefined();
+      expect(result.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe('tag-like content inside attribute values', () => {
+    it('captures full href even when it contains > inside quotes', () => {
+      const result = parseMarkup('<link href="</link>">remaining text</link>');
+      // TAG_REGEX sees through > inside quotes — full href is captured
+      // sanitiseHref (at render time) blocks it because it contains <
+      expect(result).toEqual([
+        {
+          type: 'link',
+          href: '</link>',
+          children: [{ type: 'text', content: 'remaining text' }],
+        },
+      ]);
+    });
+  });
+
+  describe('empty tags and self-closing patterns', () => {
+    it('parses empty element', () => {
+      expect(parseMarkup('<important></important>')).toEqual([{ type: 'important', children: [] }]);
+    });
+
+    it('parses empty link', () => {
+      expect(parseMarkup('<link href="/x"></link>')).toEqual([
+        { type: 'link', href: '/x', children: [] },
+      ]);
+    });
+
+    it('handles self-closing slash as unclosed tag', () => {
+      // <important/> matches TAG_REGEX as open tag with attrs="/", lacks close → text fallback
+      const result = parseMarkup('<important/>');
+      expect(result).toEqual([{ type: 'text', content: '<important/>' }]);
+    });
+  });
+
+  describe('SVG and IMG injection (regression — must remain as plain text)', () => {
+    it('treats <img> with onerror as plain text', () => {
+      expect(parseMarkup('<img src=x onerror=alert(1)>')).toEqual([
+        { type: 'text', content: '<img src=x onerror=alert(1)>' },
+      ]);
+    });
+
+    it('treats <img/> with onerror as plain text', () => {
+      expect(parseMarkup('<img/src=x onerror=alert(1)>')).toEqual([
+        { type: 'text', content: '<img/src=x onerror=alert(1)>' },
+      ]);
+    });
+
+    it('treats <svg> with onload as plain text', () => {
+      expect(parseMarkup('<svg onload=alert(1)>')).toEqual([
+        { type: 'text', content: '<svg onload=alert(1)>' },
+      ]);
+    });
+
+    it('treats <svg/> with onload as plain text', () => {
+      expect(parseMarkup('<svg/onload=alert(1)>')).toEqual([
+        { type: 'text', content: '<svg/onload=alert(1)>' },
+      ]);
+    });
+
+    it('treats <svg><script>...</script></svg> as plain text', () => {
+      expect(parseMarkup('<svg><script>alert(1)</script></svg>')).toEqual([
+        { type: 'text', content: '<svg><script>alert(1)</script></svg>' },
+      ]);
+    });
+
+    it('treats <img> inside allowed element as text child', () => {
+      const result = parseMarkup('<important><img src=x onerror=alert(1)></important>');
+      expect(result).toEqual([
+        {
+          type: 'important',
+          children: [{ type: 'text', content: '<img src=x onerror=alert(1)>' }],
+        },
+      ]);
+    });
+
+    it('treats <svg> inside allowed element as text child', () => {
+      const result = parseMarkup('<important><svg onload=alert(1)></important>');
+      expect(result).toEqual([
+        {
+          type: 'important',
+          children: [{ type: 'text', content: '<svg onload=alert(1)>' }],
+        },
+      ]);
+    });
+
+    it('treats <img> inside link as text child', () => {
+      const result = parseMarkup('<link href="/safe"><img src=x onerror=alert(1)></link>');
+      expect(result).toEqual([
+        {
+          type: 'link',
+          href: '/safe',
+          children: [{ type: 'text', content: '<img src=x onerror=alert(1)>' }],
+        },
+      ]);
+    });
+
+    it('treats <img> between text as plain text', () => {
+      expect(parseMarkup('text <img src=x onerror=alert(1)> more text')).toEqual([
+        { type: 'text', content: 'text <img src=x onerror=alert(1)> more text' },
+      ]);
+    });
+
+    it('treats <svg/onload> between text as plain text', () => {
+      expect(parseMarkup('before <svg/onload=alert(1)> after')).toEqual([
+        { type: 'text', content: 'before <svg/onload=alert(1)> after' },
+      ]);
+    });
+
+    it('treats <iframe> as plain text', () => {
+      expect(parseMarkup('<iframe src="javascript:alert(1)">')).toEqual([
+        { type: 'text', content: '<iframe src="javascript:alert(1)">' },
+      ]);
+    });
+
+    it('treats <object> as plain text', () => {
+      expect(parseMarkup('<object data="javascript:alert(1)">')).toEqual([
+        { type: 'text', content: '<object data="javascript:alert(1)">' },
+      ]);
+    });
+
+    it('treats <embed> as plain text', () => {
+      expect(parseMarkup('<embed src="javascript:alert(1)">')).toEqual([
+        { type: 'text', content: '<embed src="javascript:alert(1)">' },
+      ]);
+    });
+
+    it('treats <body onload> as plain text', () => {
+      expect(parseMarkup('<body onload=alert(1)>')).toEqual([
+        { type: 'text', content: '<body onload=alert(1)>' },
+      ]);
+    });
+
+    it('treats <input> with event handlers as plain text', () => {
+      expect(parseMarkup('<input onfocus=alert(1) autofocus>')).toEqual([
+        { type: 'text', content: '<input onfocus=alert(1) autofocus>' },
+      ]);
+    });
+
+    it('treats <details ontoggle> as plain text', () => {
+      expect(parseMarkup('<details open ontoggle=alert(1)>')).toEqual([
+        { type: 'text', content: '<details open ontoggle=alert(1)>' },
+      ]);
+    });
+  });
+
+  describe('SVG/IMG in attribute values', () => {
+    it('extracts href containing img tag (blocked by sanitiseHref at render)', () => {
+      const result = parseMarkup('<link href="<img src=x onerror=alert(1)>">text</link>');
+      // TAG_REGEX now captures > inside quotes — full href is extracted
+      // sanitiseHref blocks it at render time (contains < and >)
+      expect(result).toEqual([
+        {
+          type: 'link',
+          href: '<img src=x onerror=alert(1)>',
+          children: [{ type: 'text', content: 'text' }],
+        },
+      ]);
+    });
+
+    it('strips HTML metacharacters from accessibilityLabel containing svg', () => {
+      const result = parseMarkup(
+        '<important accessibilityLabel="<svg onload=alert(1)>">text</important>',
+      );
+      // TAG_REGEX captures the full value; sanitizeAttributeValue strips < > " '
+      const node = result[0] as { type: string; accessibilityLabel?: string };
+      expect(node.accessibilityLabel).toBe('svg onload=alert(1)');
+      expect(node.accessibilityLabel).not.toContain('<');
+      expect(node.accessibilityLabel).not.toContain('>');
+    });
+  });
+
+  describe('input length limit (DoS prevention)', () => {
+    it('returns input as plain text when exceeding MAX_INPUT_LENGTH', () => {
+      const input = 'x'.repeat(MAX_INPUT_LENGTH + 1);
+      expect(parseMarkup(input)).toEqual([{ type: 'text', content: input }]);
+    });
+
+    it('parses normally at exactly MAX_INPUT_LENGTH', () => {
+      const input = `<important>${'x'.repeat(MAX_INPUT_LENGTH - 24)}</important>`;
+      const result = parseMarkup(input);
+      expect(result[0]).toHaveProperty('type', 'important');
+    });
+
+    it('does not parse markup tags in oversized input', () => {
+      const input = `<important>text</important>${'x'.repeat(MAX_INPUT_LENGTH)}`;
+      const result = parseMarkup(input);
+      expect(result).toEqual([{ type: 'text', content: input }]);
+    });
+  });
+
+  describe('accessibilityLabel length limit', () => {
+    it('truncates accessibilityLabel exceeding MAX_ACCESSIBILITY_LABEL_LENGTH', () => {
+      const longLabel = 'a'.repeat(MAX_ACCESSIBILITY_LABEL_LENGTH + 100);
+      const result = parseMarkup(`<important accessibilityLabel="${longLabel}">text</important>`);
+      const node = result[0] as { type: string; accessibilityLabel?: string };
+      expect(node.accessibilityLabel).toHaveLength(MAX_ACCESSIBILITY_LABEL_LENGTH);
+    });
+
+    it('preserves label at exactly MAX_ACCESSIBILITY_LABEL_LENGTH', () => {
+      const exactLabel = 'b'.repeat(MAX_ACCESSIBILITY_LABEL_LENGTH);
+      const result = parseMarkup(`<important accessibilityLabel="${exactLabel}">text</important>`);
+      const node = result[0] as { type: string; accessibilityLabel?: string };
+      expect(node.accessibilityLabel).toBe(exactLabel);
+    });
+
+    it('preserves short labels unchanged', () => {
+      const result = parseMarkup(
+        '<important accessibilityLabel="Navigate to settings">text</important>',
+      );
+      const node = result[0] as { type: string; accessibilityLabel?: string };
+      expect(node.accessibilityLabel).toBe('Navigate to settings');
+    });
+  });
+});