return {"ok": True}

    # Attacker request with a spoofed root_path
    attacker_client = TestClient(app, root_path="/evil-api")
    response1 = attacker_client.get("/openapi.json")
    data1 = response1.json()
    assert any(s.get("url") == "/evil-api" for s in data1.get("servers", []))

    # Subsequent legitimate request with no root_path
    clean_client = TestClient(app)

from fastapi.openapi.docs import get_swagger_ui_html


def test_init_oauth_html_chars_are_escaped():
    xss_payload = "Evil</script><script>alert(1)</script>"
    html = get_swagger_ui_html(
        openapi_url="/openapi.json",
        title="Test",
        init_oauth={"appName": xss_payload},
    )
    body = html.body.decode()

    assert "</script><script>" not in body
    assert "\\u003c/script\\u003e\\u003cscript\\u003e" in body

 * A microbenchmark that tests the performance of contains() on various Set implementations.
 *
 * @author Kevin Bourrillion
 */
@NullUnmarked
public class SetContainsBenchmark {
  // Start at 4.88 then multiply by 2*2^phi <evil cackle> - The goal is be uniform
  // yet visit a variety of "values-relative-to-the-next-power-of-2"
  @Param({"5", "30", "180", "1100", "6900", "43000", "260000"}) // "1600000", "9800000"
  private int size;

			success: false,
		},
		// duplicate 'expiration' reject
		{

    @Override
    public boolean equals(@Nullable Object obj) {
      return obj instanceof Collider && ((Collider) obj).value == value;
    }

    @Override
    public int hashCode() {
      return 1; // evil!
    }
  }

    @Override
    public boolean equals(@Nullable Object obj) {
      return obj instanceof Collider && ((Collider) obj).value == value;
    }

    @Override
    public int hashCode() {
      return 1; // evil!
    }
  }

 * @since 11.0
 */
@GwtIncompatible
@J2ktIncompatible
public class AtomicDoubleArray implements Serializable {
  private static final long serialVersionUID = 0L;

  // Making this non-final is the lesser evil according to Effective
  // Java 2nd Edition Item 76: Write readObject methods defensively.
  private transient AtomicLongArray longs;

  /**

        final Path outsideDir = Files.createTempDirectory("outside");
        try {
            final Path hostDir = tempDir.resolve("evil.com");
            Files.createSymbolicLink(hostDir, outsideDir);

            final Map<String, Object> source = new LinkedHashMap<>();
            source.put("url", "http://evil.com/secret.html");
            source.put("content", "should not be written outside");

        // onerror attribute should be removed
        assertFalse(result.contains("onerror"));
    }

    @Test
    public void test_render_xss_iframeTag() {
        String malicious = "<iframe src=\"http://evil.com\"></iframe>";
        String result = markdownRenderer.render(malicious);
        // iframe tags should be removed
        assertFalse(result.contains("<iframe"));
        assertFalse(result.contains("</iframe>"));

        // Test multiple path traversal sequences
        File baseDir = new File(tempDir.toFile(), "images");
        baseDir.mkdirs();
        File maliciousFile = new File(baseDir, "a/b/c/../../../../../tmp/evil");

        Boolean result = invokeIsValidUploadPath(maliciousFile, baseDir);
        assertFalse("Multiple path traversals should be blocked", result);
    }

    @Test