@assert_logs(NodeLog.EDITED_TITLE, 'collection')
    def test_update_collection_sanitizes_html_properly(self):
        new_title = '<strong>Super</strong><script>alert("even cooler")</script> Cool Project'
        res = self.app.put_json_api(self.url, {
            'data': {
                'id': self.collection._id,
                'type': 'collections',
                'attributes': {
                    'title': new_title,
                }
            }
        }, auth=self.user.auth)
        assert_equal(res.status_code, 200)
        assert_equal(res.content_type, 'application/vnd.api+json')
        assert_equal(res.json['data']['attributes']['title'], strip_html(new_title))
        self.collection.reload()
        assert_equal(self.collection.title, strip_html(new_title))
Post request should update resource, and any HTML in fields should be stripped
dataset/ETHPy150Open CenterForOpenScience/osf.io/api_tests/collections/test_views.py/TestCollectionUpdate.test_update_collection_sanitizes_html_properly