From df9070a47dca05e26767787a3b4e6643ca1f2df0 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 10:06:01 -1000 Subject: Check that markup inside a token is escaped Every escape the checks looked at sat between tokens or in the tail a lexer left untagged, so a filter that escaped only those would have passed with a string literal reaching the page raw. --- tests/extensions/test-syntax-highlight.lua | 3 +++ tests/t0502-syntax-highlight.sh | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/extensions/test-syntax-highlight.lua b/tests/extensions/test-syntax-highlight.lua index 8acbf91..b54dc84 100644 --- a/tests/extensions/test-syntax-highlight.lua +++ b/tests/extensions/test-syntax-highlight.lua @@ -59,6 +59,9 @@ h.contains("bytes between tokens are escaped", out, " & ") h.contains("later tokens still highlight", out, "zz") h.equals("close answers zero", ret, 0) +out = render("hello.fake", "'&'") +h.equals("markup inside a token is escaped", out, "'<b>&'") + out = render("hello.fake", "$color :hover") h.contains("a css property takes the number class", out, "$color") h.contains("a css pseudo-class takes the function class", out, ":hover") diff --git a/tests/t0502-syntax-highlight.sh b/tests/t0502-syntax-highlight.sh index 186d0a8..4b32f82 100755 --- a/tests/t0502-syntax-highlight.sh +++ b/tests/t0502-syntax-highlight.sh @@ -35,7 +35,7 @@ test_expect_success 'create a repository holding a lexable file' ' test_create_repo repos/fake && ( cd repos/fake && - echo "if 42 & zz" >hello.fake && + echo "if 42 & zz $SQ$SQ" >hello.fake && git add hello.fake && git commit -m "add hello" ) @@ -56,7 +56,8 @@ test_expect_success 'place the fake lexers beside a config naming the filter' ' test_expect_success CGIT_LUA 'the tree view is highlighted' ' cgit_ok_url "fake/tree/hello.fake" >tmp && test_grep "if" tmp && - test_grep "42" tmp + test_grep "42" tmp && + test_grep ".<b>." tmp ' test_expect_success CGIT_LUA 'bytes between tokens reach the page escaped' ' -- cgit 2.12.1