From 3231f195e626c2e6dfd4891cdcbe60a1528b66dc Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 10:08:04 -1000 Subject: Check that link-commits encodes a rule capture Every capture the checks used was hex or digits, which encoding leaves alone, so the filter passed with url_encode gone and a broader rule could then have broken out of the href. --- tests/extensions/test-link-commits.lua | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/extensions/test-link-commits.lua b/tests/extensions/test-link-commits.lua index fdd1787..ea342bf 100644 --- a/tests/extensions/test-link-commits.lua +++ b/tests/extensions/test-link-commits.lua @@ -76,4 +76,11 @@ h.equals("an empty message still answers zero", ret, 0) out = render("plain words only") h.equals("a message with no matches passes through", out, "plain words only") +-- A rule broad enough to capture a quote or a percent sign still has to +-- leave a url that stays inside its attribute and means what it says. +h.load_with(arg[1], { { "local rules = {", "local rules = { { pattern = \"T:(%S+)\", url = \"https://t/%s\" }," } }) + +out = render("T:a'b%c") +h.equals("a captured value is percent-encoded into the url", out, "T:a'b%c") + h.finish() -- cgit 2.12.1