From c1c8d742e8c014b2bb7da9f2c170772251b00e77 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 09:58:18 -1000
Subject: Prove a control byte cannot hide a link's scheme

The old check split the scheme with a newline, which ends the line
before a link can form, so it passed with the strip removed.
---
 tests/extensions/test-about-render.lua | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.lua
index 45cc5b3..6088e01 100644
--- a/tests/extensions/test-about-render.lua
+++ b/tests/extensions/test-about-render.lua
@@ -207,8 +207,15 @@ out = render("README.md", "[bad](javascript:alert(1))")
 h.excludes("a javascript link renders no anchor", out, "<a ")
 h.contains("its text still reaches the page", out, "bad")
 
-out = render("README.md", "[bad](java\nscript:alert(1))")
-h.excludes("a split scheme is still caught", out, "<a ")
+-- A target cannot span lines, so a control byte is what could hide its
+-- scheme, and a browser drops one that comes before it.
+out = render("README.md", "[bad](\1javascript:alert%281%29)")
+h.excludes("a control byte before a scheme is still caught", out, "<a ")
+h.contains("and only the text reaches the page", out, "<p>bad</p>")
+
+out = render("README.md", "[bad](java\1script:alert%281%29)")
+h.excludes("a control byte inside a scheme is still caught", out, "<a ")
+h.contains("and only that text reaches the page", out, "<p>bad</p>")
 
 out = render("README.md", "[bad](//evil.example/x)")
 h.excludes("a scheme relative link renders no anchor", out, "<a ")
-- 
cgit 2.12.1