Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Link the urls and addresses in angle brackets
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/extensions/test-about-render.lua | 8 |
1 file changed, 8 insertions, 0 deletions
diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.lua index eb62a89..601d0dc 100644 --- a/tests/extensions/test-about-render.lua +++ b/tests/extensions/test-about-render.lua @@ -153,6 +153,14 @@ h.contains("an absolute link is left alone", out, "href='https://example.com/x'" out = render("README.md", "[mail](mailto:a@example.com)") h.contains("a mailto link renders as an anchor", out, "<a href='mailto:a@example.com'>mail</a>") +out = render("README.md", "see <https://example.com/a?b=1> or <me@example.com>") +h.contains("a url in angle brackets links", out, "<a href='https://example.com/a?b=1'>https://example.com/a?b=1</a>") +h.contains("an address in angle brackets links", out, "<a href='mailto:me@example.com'>me@example.com</a>") + +out = render("README.md", "<javascript:alert(1)> and <b>") +h.excludes("an unsafe autolink renders no anchor", out, "<a ") +h.contains("other angle brackets stay text", out, "<b>") + out = render("README.md", "[bad](javascript:alert(1))") h.excludes("a javascript link renders no anchor", out, "<a ") h.contains("its text still reaches the page", out, "bad") |