From 1b622d0846dad3a99a1943f5d7cfc47d0b0e7ddc Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Fri, 16 Oct 2026 17:58:29 -1000
Subject: Leave images and badges out of rendered readmes

A relative image loaded from below the about page, which answers 404
now, and a remote one had every visitor's browser call a third party.
A badge also came out as a link to its own image, wrapped in stray
brackets.
---
 tests/extensions/test-about-render.lua | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

(limited to 'tests/extensions/test-about-render.lua')

diff --git a/tests/extensions/test-about-render.lua b/tests/extensions/test-about-render.lua
index 4f8b532..801cc45 100644
--- a/tests/extensions/test-about-render.lua
+++ b/tests/extensions/test-about-render.lua
@@ -159,13 +159,14 @@ h.excludes("a scheme relative link renders no anchor", out, "<a ")
 out = render("README.md", "[q](https://example.com/a'b)")
 h.contains("a quote in a link target is escaped", out, "href='https://example.com/a&#x27;b'")
 
-out = render("README.md", "![a & b](https://example.com/i.png)")
-h.contains("an image renders with its alt text escaped", out,
-	"<img src='https://example.com/i.png' alt='a &amp; b'>")
+out = render("README.md", "an ![a & b](https://example.com/i.png) image")
+h.contains("an image is left out", out, "<p>an  image</p>")
 
-out = render("README.md", "![alt](data:image/png;base64,x)")
-h.excludes("an unsafe image renders no tag", out, "<img")
-h.contains("its alt text is kept as text", out, "![alt]")
+out = render("README.md", "a [![ci](https://ci.example/b.svg)](https://ci.example/) badge")
+h.contains("a badge is left out with its link", out, "<p>a  badge</p>")
+
+out = render("README.md", "[![a](x.svg)](y)\n![b](z.svg)\n\ntext")
+h.contains("a paragraph of badges leaves nothing behind", out, "<div class='markdown'><p>text</p></div>")
 
 out = render("README.md", "```lua\nlocal x = 1 < 2\n```\nafter")
 h.contains("a fenced block carries its language", out,
-- 
cgit