Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check that link-commits encodes a rule capture
Every capture the checks used was hex or digits, which encoding leaves
alone, so the filter passed with url_encode gone and a broader rule
could then have broken out of the href.
Diffstat (limited to 'tests/extensions')
| -rw-r--r-- | tests/extensions/test-link-commits.lua | 7 |
1 file changed, 7 insertions, 0 deletions
diff --git a/tests/extensions/test-link-commits.lua b/tests/extensions/test-link-commits.lua index fdd1787..ea342bf 100644 --- a/tests/extensions/test-link-commits.lua +++ b/tests/extensions/test-link-commits.lua @@ -76,4 +76,11 @@ h.equals("an empty message still answers zero", ret, 0) out = render("plain words only") h.equals("a message with no matches passes through", out, "plain words only") +-- A rule broad enough to capture a quote or a percent sign still has to +-- leave a url that stays inside its attribute and means what it says. +h.load_with(arg[1], { { "local rules = {", "local rules = { { pattern = \"T:(%S+)\", url = \"https://t/%s\" }," } }) + +out = render("T:a'b%c") +h.equals("a captured value is percent-encoded into the url", out, "<a href='https://t/a%27b%25c'>T:a'b%c</a>") + h.finish() |