1 file changed, 24 insertions, 6 deletions
diff --git a/tests/extensions/test-email-avatar.lua b/tests/extensions/test-email-avatar.lua
index 40375c8..5929634 100644
--- a/tests/extensions/test-email-avatar.lua
+++ b/tests/extensions/test-email-avatar.lua
@@ -14,7 +14,7 @@ local script = arg[1]
 local mode = h.mode("stub", "missing", "real")
 
 local base_url = "https://gravatar.com/avatar/"
-if script:find("libravatar", 1, true) then
+if script:match("[^/]*$"):find("libravatar", 1, true) then
 	base_url = "https://seccdn.libravatar.org/avatar/"
 end
 
@@ -44,9 +44,14 @@ if mode == "missing" then
 	h.finish()
 end
 
+local prefix = base_url:gsub("([%^%$%(%)%%%.%[%]%*%+%-%?])", "%%%1")
+
+local function hash_in(attribute, output)
+	return output:match(attribute .. "='" .. prefix .. "([0-9a-f]+)%?")
+end
+
 local function hash_of(output)
-	local prefix = base_url:gsub("([%^%$%(%)%%%.%[%]%*%+%-%?])", "%%%1")
-	return output:match("src='" .. prefix .. "(%x+)%?")
+	return hash_in("src", output)
 end
 
 local out, ret = render("<author@example.com>", "A U Thor")
@@ -61,17 +66,22 @@ h.contains("the fetch carries no Referer", out, "referrerpolicy='no-referrer'")
 h.contains("the name follows the icon", out, "> A U Thor")
 h.equals("close answers zero", ret, 0)
 h.check("the hash is hex", hash_of(out) ~= nil)
+h.equals("the dense image is of the same address", hash_in("srcset", out), hash_of(out))
+if mode == "stub" then
+	h.equals("the hash is of the bare address in two hex digits a byte", hash_of(out),
+		"8318f94a3e09d48151cb849a783e6895")
+end
 
 -- The service hashes the trimmed lowercase address, so every spelling of one
 -- address has to reach it as the same hash.
 local plain = hash_of(render("author@example.com", "x"))
 local wrapped = hash_of(render("<author@example.com>", "x"))
 local shouting = hash_of(render("  <AUTHOR@Example.COM>  ", "x"))
-h.check("angle brackets do not change the hash", plain == wrapped)
+h.check("angle brackets do not change the hash", plain ~= nil and plain == wrapped)
 h.check("case and padding do not change the hash", plain == shouting)
 
 local other = hash_of(render("other@example.com", "x"))
-h.check("a different address hashes differently", plain ~= other)
+h.check("a different address hashes differently", other ~= nil and plain ~= other)
 
 out = render(nil, "A U Thor")
 h.equals("no address draws no icon", out, "A U Thor")
@@ -85,6 +95,11 @@ h.equals("empty angle brackets draw no icon", out, "A U Thor")
 out = h.run({ "<author@example.com>", "commit" }, { "A U ", "Thor" })
 h.contains("the name is buffered across writes", out, "> A U Thor")
 
+-- cgit hands the name over already escaped.
+out = render("<author@example.com>", "A &amp; B")
+h.contains("a name keeps the escaping cgit gave it", out, "> A &amp; B")
+h.excludes("and is not escaped again", out, "&amp;amp;")
+
 -- A commit can carry any bytes in its address, and a log page runs the
 -- filter once per row, so the trim has to stay linear in a run of spaces.
 local started = os.clock()
@@ -95,9 +110,12 @@ started = os.clock()
 render(string.rep("<", 40000), "x")
 h.check("a long run of open brackets is unwrapped quickly", os.clock() - started < 0.5)
 
-h.check("the outermost brackets are the ones taken off",
+h.check("text around the brackets is dropped",
 	hash_of(render("x <author@example.com> y", "x")) == plain)
 
+local reversed = hash_of(render("a>b<c", "x"))
+h.check("a close before the open unwraps nothing", reversed ~= nil and reversed ~= plain)
+
 if mode == "real" then
 	out = render("test@example.com", "x")
 	h.equals("a known address hashes to its sha256", hash_of(out),