Leave images and badges out of rendered readmes

A relative image loaded from below the about page, which answers 404
now, and a remote one had every visitor's browser call a third party.
A badge also came out as a link to its own image, wrapped in stray
brackets.

1 file changed, 7 insertions, 6 deletions

diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.luaindex 4f8b532..801cc45 100644--- a/tests/extensions/test-about-render.lua+++ b/tests/extensions/test-about-render.lua@@ -159,13 +159,14 @@ h.excludes("a scheme relative link renders no anchor", out, "<a ") out = render("README.md", "[q](https://example.com/a'b)") h.contains("a quote in a link target is escaped", out, "href='https://example.com/a&#x27;b'") -out = render("README.md", "![a & b](https://example.com/i.png)")-h.contains("an image renders with its alt text escaped", out,-	"<img src='https://example.com/i.png' alt='a &amp; b'>")+out = render("README.md", "an ![a & b](https://example.com/i.png) image")+h.contains("an image is left out", out, "<p>an  image</p>") -out = render("README.md", "![alt](data:image/png;base64,x)")-h.excludes("an unsafe image renders no tag", out, "<img")-h.contains("its alt text is kept as text", out, "![alt]")+out = render("README.md", "a [![ci](https://ci.example/b.svg)](https://ci.example/) badge")+h.contains("a badge is left out with its link", out, "<p>a  badge</p>")++out = render("README.md", "[![a](x.svg)](y)\n![b](z.svg)\n\ntext")+h.contains("a paragraph of badges leaves nothing behind", out, "<div class='markdown'><p>text</p></div>")  out = render("README.md", "```lua\nlocal x = 1 < 2\n```\nafter") h.contains("a fenced block carries its language", out,
diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.lua
index 4f8b532..801cc45 100644
--- a/tests/extensions/test-about-render.lua
+++ b/tests/extensions/test-about-render.lua
@@ -159,13 +159,14 @@ h.excludes("a scheme relative link renders no anchor", out, "<a ")
 out = render("README.md", "[q](https://example.com/a'b)")
 h.contains("a quote in a link target is escaped", out, "href='https://example.com/a&#x27;b'")
 
-out = render("README.md", "![a & b](https://example.com/i.png)")
-h.contains("an image renders with its alt text escaped", out,
-	"<img src='https://example.com/i.png' alt='a &amp; b'>")
+out = render("README.md", "an ![a & b](https://example.com/i.png) image")
+h.contains("an image is left out", out, "<p>an  image</p>")
 
-out = render("README.md", "![alt](data:image/png;base64,x)")
-h.excludes("an unsafe image renders no tag", out, "<img")
-h.contains("its alt text is kept as text", out, "![alt]")
+out = render("README.md", "a [![ci](https://ci.example/b.svg)](https://ci.example/) badge")
+h.contains("a badge is left out with its link", out, "<p>a  badge</p>")
+
+out = render("README.md", "[![a](x.svg)](y)\n![b](z.svg)\n\ntext")
+h.contains("a paragraph of badges leaves nothing behind", out, "<div class='markdown'><p>text</p></div>")
 
 out = render("README.md", "```lua\nlocal x = 1 < 2\n```\nafter")
 h.contains("a fenced block carries its language", out,