test(engine): 增加 cleanSvgForCanvas 净化与防污染单元测试

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/engine/renderers.test.ts

@@ -7,6 +7,7 @@ import {
   parseInlineContent,
   latexToOmml,
   sanitizeMermaidCode,
+  cleanSvgForCanvas,
 } from './docxRenderer';
 import { buildXlsxWorkbook, exportDocumentToXlsx } from './xlsxRenderer';
 import { Packer, ImportedXmlComponent } from 'docx';
@@ -71,6 +72,15 @@ test('DOCX 渲染器 Mermaid 语法净化与容错测试 (sanitizeMermaidCode)',
   assert.ok(sanitized.includes('Display["4K医用级超低延迟监视器 (延时 < 35ms)"]'));
 });
 
+test('DOCX 渲染器 SVG 净化防 Canvas 污染测试 (cleanSvgForCanvas)', () => {
+  const dirtySvg = `<svg><style>@import url("https://fonts.googleapis.com/css?family=Open+Sans");</style><foreignObject width="100" height="40"><div><span>双CMOS分光棱镜</span></div></foreignObject></svg>`;
+  const cleaned = cleanSvgForCanvas(dirtySvg);
+
+  assert.ok(!cleaned.includes('@import'), '应彻底剥离 @import 外部网络字体');
+  assert.ok(!cleaned.includes('<foreignObject'), '应彻底移除或转换为 SVG 原生 <text>，杜绝 Tainted Canvas');
+  assert.ok(cleaned.includes('双CMOS分光棱镜'), '必须保留节点文本内容');
+});
+
 test('DOCX 渲染器全量编译测试 (buildDocxModel & exportDocumentToDocx)', async () => {
   const ast = markdownToBlockAST(SAMPLE_MD, {
     docId: 'doc_docx_test_001',