fix(audit): fermer les frontieres restantes

tests/test_csp.py

@@ -117,6 +117,23 @@ class TestInlineHandlerRatchet:
 
         assert _count_handlers(template) == 1
 
+    def test_dynamic_player_names_are_escaped_before_html_insertion(self):
+        template = os.path.join(TEMPLATE_ROOT, 'pages', 'match_form.html')
+        with open(template, encoding='utf-8') as handle:
+            content = handle.read()
+
+        assert 'html += playerName;' not in content
+        assert "' + playerName + '" not in content
+        assert content.count('escapeHtml(playerName)') == 6
+
+    def test_api_messages_are_written_as_text(self):
+        template = os.path.join(TEMPLATE_ROOT, 'pages', 'coach_availability.html')
+        with open(template, encoding='utf-8') as handle:
+            content = handle.read()
+
+        assert 'text.textContent = message' in content
+        assert "alert.innerHTML = '<span>' + message" not in content
+
     @pytest.mark.parametrize('relative,full', list(_templates()))
     def test_a_template_never_gains_an_inline_handler(self, relative, full):
         allowed = HANDLER_BUDGET.get(relative, 0)