Leave images and badges out of rendered readmes

A relative image loaded from below the about page, which answers 404
now, and a remote one had every visitor's browser call a third party.
A badge also came out as a link to its own image, wrapped in stray
brackets.

2 files changed, 35 insertions, 27 deletions

diff --git a/custom/extensions/about-render.lua b/custom/extensions/about-render.luaindex a3932af..9d5f72d 100644--- a/custom/extensions/about-render.lua+++ b/custom/extensions/about-render.lua@@ -156,8 +156,8 @@ end  -- The page renders untrusted repository content. Every run of text goes out -- through cgit's html_txt, every attribute value through html_attr or, for a--- path in the tree, html_url_path, and every link or image target through--- safe_url first. html() only ever gets literal tag scaffolding.+-- path in the tree, html_url_path, and every link target through safe_url+-- first. html() only ever gets literal tag scaffolding.  local emit_inline @@ -181,19 +181,22 @@ emit_inline = function(list) 			else 				emit_inline(node.kids) 			end-		elseif kind == "image" then-			local target = safe_url(node.url)-			if target then-				html("<img src='")-				html_attr(target)-				html("' alt='")-				html_attr(node.alt)-				html("'>")-			else-				html_txt("![" .. node.alt .. "]")+		end+	end+end++-- Whether a paragraph has anything to show once images are left out, so a+-- row of badges leaves no empty paragraph behind.+local function shows_something(lines)+	for _, line in ipairs(lines) do+		for _, node in ipairs(line) do+			local blank = node.kind == "text" and not node.text:find("%S")+			if node.kind ~= "image" and not blank then+				return true 			end 		end 	end+	return false end  local emit_blocks@@ -248,7 +251,7 @@ emit_blocks = function(blocks) 				html("</li>") 			end 			html("</" .. tag .. ">")-		elseif kind == "para" then+		elseif kind == "para" and shows_something(block.lines) then 			html("<p>") 			for i, line in ipairs(block.lines) do 				if i > 1 then@@ -310,18 +313,22 @@ if has_lpeg then 	local function node_link(text, url) 		return { kind = "link", kids = parse_inline(text), url = url } 	end-	local function node_image(alt, url)-		return { kind = "image", alt = alt, url = url }+	local function node_image()+		return { kind = "image" } 	end +	local label = P("[") * C((1 - P("]")) ^ (-max_scan)) * P("]")+	local target = P("(") * space ^ 0 * C(url_char * url_char ^ (-max_scan))+		* (1 - P(")")) ^ (-max_scan) * P(")")++	-- Images are parsed only to be left out, along with the link around a+	-- badge. The about page serves no files for a relative one to load, and+	-- a remote one would have every visitor's browser call a third party. 	local inline_grammar = Ct(( 		  (P("`") * C((1 - P("`")) ^ 1) * P("`")) / node_code-		+ (P("![") * C((1 - P("]")) ^ (-max_scan)) * P("]") * P("(")-			* space ^ 0 * C(url_char * url_char ^ (-max_scan))-			* (1 - P(")")) ^ (-max_scan) * P(")")) / node_image-		+ (P("[") * C((1 - P("]")) ^ (-max_scan)) * P("]") * P("(")-			* space ^ 0 * C(url_char * url_char ^ (-max_scan))-			* (1 - P(")")) ^ (-max_scan) * P(")")) / node_link+		+ (P("[!") * label * target * P("]") * target) / node_image+		+ (P("!") * label * target) / node_image+		+ (label * target) / node_link 		+ (P("**") * C((1 - P("**")) ^ 1) * P("**")) / node_strong 		+ (P("__") * C((1 - P("__")) ^ 1) * P("__")) / node_strong 		+ (P("*") * C((1 - whitespace) * (1 - P("*")) ^ 0) * P("*")) / node_em
diff --git a/custom/extensions/about-render.lua b/custom/extensions/about-render.lua
index a3932af..9d5f72d 100644
--- a/custom/extensions/about-render.lua
+++ b/custom/extensions/about-render.lua
@@ -156,8 +156,8 @@ end
 
 -- The page renders untrusted repository content. Every run of text goes out
 -- through cgit's html_txt, every attribute value through html_attr or, for a
--- path in the tree, html_url_path, and every link or image target through
--- safe_url first. html() only ever gets literal tag scaffolding.
+-- path in the tree, html_url_path, and every link target through safe_url
+-- first. html() only ever gets literal tag scaffolding.
 
 local emit_inline
 
@@ -181,19 +181,22 @@ emit_inline = function(list)
 			else
 				emit_inline(node.kids)
 			end
-		elseif kind == "image" then
-			local target = safe_url(node.url)
-			if target then
-				html("<img src='")
-				html_attr(target)
-				html("' alt='")
-				html_attr(node.alt)
-				html("'>")
-			else
-				html_txt("![" .. node.alt .. "]")
+		end
+	end
+end
+
+-- Whether a paragraph has anything to show once images are left out, so a
+-- row of badges leaves no empty paragraph behind.
+local function shows_something(lines)
+	for _, line in ipairs(lines) do
+		for _, node in ipairs(line) do
+			local blank = node.kind == "text" and not node.text:find("%S")
+			if node.kind ~= "image" and not blank then
+				return true
 			end
 		end
 	end
+	return false
 end
 
 local emit_blocks
@@ -248,7 +251,7 @@ emit_blocks = function(blocks)
 				html("</li>")
 			end
 			html("</" .. tag .. ">")
-		elseif kind == "para" then
+		elseif kind == "para" and shows_something(block.lines) then
 			html("<p>")
 			for i, line in ipairs(block.lines) do
 				if i > 1 then
@@ -310,18 +313,22 @@ if has_lpeg then
 	local function node_link(text, url)
 		return { kind = "link", kids = parse_inline(text), url = url }
 	end
-	local function node_image(alt, url)
-		return { kind = "image", alt = alt, url = url }
+	local function node_image()
+		return { kind = "image" }
 	end
 
+	local label = P("[") * C((1 - P("]")) ^ (-max_scan)) * P("]")
+	local target = P("(") * space ^ 0 * C(url_char * url_char ^ (-max_scan))
+		* (1 - P(")")) ^ (-max_scan) * P(")")
+
+	-- Images are parsed only to be left out, along with the link around a
+	-- badge. The about page serves no files for a relative one to load, and
+	-- a remote one would have every visitor's browser call a third party.
 	local inline_grammar = Ct((
 		  (P("`") * C((1 - P("`")) ^ 1) * P("`")) / node_code
-		+ (P("![") * C((1 - P("]")) ^ (-max_scan)) * P("]") * P("(")
-			* space ^ 0 * C(url_char * url_char ^ (-max_scan))
-			* (1 - P(")")) ^ (-max_scan) * P(")")) / node_image
-		+ (P("[") * C((1 - P("]")) ^ (-max_scan)) * P("]") * P("(")
-			* space ^ 0 * C(url_char * url_char ^ (-max_scan))
-			* (1 - P(")")) ^ (-max_scan) * P(")")) / node_link
+		+ (P("[!") * label * target * P("]") * target) / node_image
+		+ (P("!") * label * target) / node_image
+		+ (label * target) / node_link
 		+ (P("**") * C((1 - P("**")) ^ 1) * P("**")) / node_strong
 		+ (P("__") * C((1 - P("__")) ^ 1) * P("__")) / node_strong
 		+ (P("*") * C((1 - whitespace) * (1 - P("*")) ^ 0) * P("*")) / node_em
diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.luaindex 4f8b532..801cc45 100644--- a/tests/extensions/test-about-render.lua+++ b/tests/extensions/test-about-render.lua@@ -159,13 +159,14 @@ h.excludes("a scheme relative link renders no anchor", out, "<a ") out = render("README.md", "[q](https://example.com/a'b)") h.contains("a quote in a link target is escaped", out, "href='https://example.com/a&#x27;b'") -out = render("README.md", "![a & b](https://example.com/i.png)")-h.contains("an image renders with its alt text escaped", out,-	"<img src='https://example.com/i.png' alt='a &amp; b'>")+out = render("README.md", "an ![a & b](https://example.com/i.png) image")+h.contains("an image is left out", out, "<p>an  image</p>") -out = render("README.md", "![alt](data:image/png;base64,x)")-h.excludes("an unsafe image renders no tag", out, "<img")-h.contains("its alt text is kept as text", out, "![alt]")+out = render("README.md", "a [![ci](https://ci.example/b.svg)](https://ci.example/) badge")+h.contains("a badge is left out with its link", out, "<p>a  badge</p>")++out = render("README.md", "[![a](x.svg)](y)\n![b](z.svg)\n\ntext")+h.contains("a paragraph of badges leaves nothing behind", out, "<div class='markdown'><p>text</p></div>")  out = render("README.md", "```lua\nlocal x = 1 < 2\n```\nafter") h.contains("a fenced block carries its language", out,
diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.lua
index 4f8b532..801cc45 100644
--- a/tests/extensions/test-about-render.lua
+++ b/tests/extensions/test-about-render.lua
@@ -159,13 +159,14 @@ h.excludes("a scheme relative link renders no anchor", out, "<a ")
 out = render("README.md", "[q](https://example.com/a'b)")
 h.contains("a quote in a link target is escaped", out, "href='https://example.com/a&#x27;b'")
 
-out = render("README.md", "![a & b](https://example.com/i.png)")
-h.contains("an image renders with its alt text escaped", out,
-	"<img src='https://example.com/i.png' alt='a &amp; b'>")
+out = render("README.md", "an ![a & b](https://example.com/i.png) image")
+h.contains("an image is left out", out, "<p>an  image</p>")
 
-out = render("README.md", "![alt](data:image/png;base64,x)")
-h.excludes("an unsafe image renders no tag", out, "<img")
-h.contains("its alt text is kept as text", out, "![alt]")
+out = render("README.md", "a [![ci](https://ci.example/b.svg)](https://ci.example/) badge")
+h.contains("a badge is left out with its link", out, "<p>a  badge</p>")
+
+out = render("README.md", "[![a](x.svg)](y)\n![b](z.svg)\n\ntext")
+h.contains("a paragraph of badges leaves nothing behind", out, "<div class='markdown'><p>text</p></div>")
 
 out = render("README.md", "```lua\nlocal x = 1 < 2\n```\nafter")
 h.contains("a fenced block carries its language", out,