Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Prove a control byte cannot hide a link's scheme
The old check split the scheme with a newline, which ends the line
before a link can form, so it passed with the strip removed.
Diffstat (limited to 'tests/extensions/test-about-render.lua')
| -rw-r--r-- | tests/extensions/test-about-render.lua | 11 |
1 file changed, 9 insertions, 2 deletions
diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.lua index 45cc5b3..6088e01 100644 --- a/tests/extensions/test-about-render.lua +++ b/tests/extensions/test-about-render.lua @@ -207,8 +207,15 @@ out = render("README.md", "[bad](javascript:alert(1))") h.excludes("a javascript link renders no anchor", out, "<a ") h.contains("its text still reaches the page", out, "bad") -out = render("README.md", "[bad](java\nscript:alert(1))") -h.excludes("a split scheme is still caught", out, "<a ") +-- A target cannot span lines, so a control byte is what could hide its +-- scheme, and a browser drops one that comes before it. +out = render("README.md", "[bad](\1javascript:alert%281%29)") +h.excludes("a control byte before a scheme is still caught", out, "<a ") +h.contains("and only the text reaches the page", out, "<p>bad</p>") + +out = render("README.md", "[bad](java\1script:alert%281%29)") +h.excludes("a control byte inside a scheme is still caught", out, "<a ") +h.contains("and only that text reaches the page", out, "<p>bad</p>") out = render("README.md", "[bad](//evil.example/x)") h.excludes("a scheme relative link renders no anchor", out, "<a ") |