Link the urls and addresses in angle brackets

1 file changed, 8 insertions, 0 deletions

diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.luaindex eb62a89..601d0dc 100644--- a/tests/extensions/test-about-render.lua+++ b/tests/extensions/test-about-render.lua@@ -153,6 +153,14 @@ h.contains("an absolute link is left alone", out, "href='https://example.com/x'" out = render("README.md", "[mail](mailto:a@example.com)") h.contains("a mailto link renders as an anchor", out, "<a href='mailto:a@example.com'>mail</a>") +out = render("README.md", "see <https://example.com/a?b=1> or <me@example.com>")+h.contains("a url in angle brackets links", out, "<a href='https://example.com/a?b=1'>https://example.com/a?b=1</a>")+h.contains("an address in angle brackets links", out, "<a href='mailto:me@example.com'>me@example.com</a>")++out = render("README.md", "<javascript:alert(1)> and <b>")+h.excludes("an unsafe autolink renders no anchor", out, "<a ")+h.contains("other angle brackets stay text", out, "&lt;b&gt;")+ out = render("README.md", "[bad](javascript:alert(1))") h.excludes("a javascript link renders no anchor", out, "<a ") h.contains("its text still reaches the page", out, "bad")
diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.lua
index eb62a89..601d0dc 100644
--- a/tests/extensions/test-about-render.lua
+++ b/tests/extensions/test-about-render.lua
@@ -153,6 +153,14 @@ h.contains("an absolute link is left alone", out, "href='https://example.com/x'"
 out = render("README.md", "[mail](mailto:a@example.com)")
 h.contains("a mailto link renders as an anchor", out, "<a href='mailto:a@example.com'>mail</a>")
 
+out = render("README.md", "see <https://example.com/a?b=1> or <me@example.com>")
+h.contains("a url in angle brackets links", out, "<a href='https://example.com/a?b=1'>https://example.com/a?b=1</a>")
+h.contains("an address in angle brackets links", out, "<a href='mailto:me@example.com'>me@example.com</a>")
+
+out = render("README.md", "<javascript:alert(1)> and <b>")
+h.excludes("an unsafe autolink renders no anchor", out, "<a ")
+h.contains("other angle brackets stay text", out, "&lt;b&gt;")
+
 out = render("README.md", "[bad](javascript:alert(1))")
 h.excludes("a javascript link renders no anchor", out, "<a ")
 h.contains("its text still reaches the page", out, "bad")