toSvg('https://example.com', []); expect($svg)->toContain('toContain(''); }); it('generates png as base64', function () { $renderer = new QrRenderer; $png = $renderer->toPngBase64('https://example.com', []); expect($png)->toStartWith('data:image/png;base64,'); }); it('builds url payload', function () { $renderer = new QrRenderer; expect($renderer->buildPayload('url', ['url' => 'https://example.com'])) ->toBe('https://example.com'); }); it('builds wifi payload', function () { $renderer = new QrRenderer; expect($renderer->buildPayload('wifi', [ 'encryption' => 'WPA', 'ssid' => 'My Network', 'password' => 'pass;word', ]))->toBe('WIFI:T:WPA;S:My Network;P:pass\\;word;;'); }); it('sanitizes vcard injection', function () { $renderer = new QrRenderer; $payload = $renderer->buildPayload('vcard', [ 'name' => "Evil\nINJECTED:property", 'email' => 'x@example.com', 'phone' => '123', ]); // Newline stripped so "INJECTED:property" cannot appear as a separate vCard property line expect($payload)->not->toContain("\nINJECTED"); });