// The malicious tags are contained within the safe boundaries

const startMatch = result.match(/<<<EXTERNAL_UNTRUSTED_CONTENT id="[a-f0-9]{16}">>>/);

expect(startMatch).not.toBeNull();

expect(result.indexOf(startMatch![0])).toBeLessThan(result.indexOf("</user>"));

if (startMatch === null) {

throw new Error("Expected external content start marker");

}

expect(result.indexOf(startMatch[0])).toBeLessThan(result.indexOf("</user>"));

});

});

});