return {"ok": True}

    # Attacker request with a spoofed root_path
    attacker_client = TestClient(app, root_path="/evil-api")
    response1 = attacker_client.get("/openapi.json")
    data1 = response1.json()
    assert any(s.get("url") == "/evil-api" for s in data1.get("servers", []))

    # Subsequent legitimate request with no root_path
    clean_client = TestClient(app)

from fastapi.openapi.docs import get_swagger_ui_html


def test_init_oauth_html_chars_are_escaped():
    xss_payload = "Evil</script><script>alert(1)</script>"
    html = get_swagger_ui_html(
        openapi_url="/openapi.json",
        title="Test",
        init_oauth={"appName": xss_payload},
    )
    body = html.body.decode()

    assert "</script><script>" not in body
    assert "\\u003c/script\\u003e\\u003cscript\\u003e" in body

        final Path outsideDir = Files.createTempDirectory("outside");
        try {
            final Path hostDir = tempDir.resolve("evil.com");
            Files.createSymbolicLink(hostDir, outsideDir);

            final Map<String, Object> source = new LinkedHashMap<>();
            source.put("url", "http://evil.com/secret.html");
            source.put("content", "should not be written outside");

dns\u0007httpbin\nip-dynamic\u000eis-a-bruinsfan\u000eis-a-candidate\u000fis-a-celticsfan\u000bis-a-knight\u000fis-a-linux-user\u000cis-a-patsfan\u000bis-a-soxfan\u0008is-found\u0008is-local\u0007is-lost\u0008is-saved\u000bis-very-bad\u000cis-very-evil\u000cis-very-good\u000cis-very-nice\ris-very-sweet\u000bmisconfused\u0006mlbfan\u000bmy-firewall\nmyfirewall\u0006mywire\u0006nflfan\u0008pimienta\u0007poivron\u0007potager\u0006pubtls\nread-books\nreadmyblog\u0004roxa\rsellsyourhome\u0009small-we...