From 4a3589526e7046bbc5d2d0121e7d93134df7f2b9 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 10:59:48 -1000
Subject: Cover how link-trailers applies its rules

Skipping a malformed rule, a rule without a key, the switch for bare
urls and the shipped CVE example were untested, and the only url kept
from linking was one holding a quote, so a broader scheme check would
have let javascript:// through.
---
 tests/extensions/test-link-trailers.lua | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

(limited to 'tests/extensions')

diff --git a/tests/extensions/test-link-trailers.lua b/tests/extensions/test-link-trailers.lua
index 01854a0..c4dfdf5 100644
--- a/tests/extensions/test-link-trailers.lua
+++ b/tests/extensions/test-link-trailers.lua
@@ -80,4 +80,30 @@ h.load_with(script, { { "local rules = {", "local rules = { { key = \"Ref\", pat
 out = render("Ref", "a'b%c")
 h.equals("a captured value is percent-encoded into the url", out, "<a href='https://t/a%27b%25c'>a'b%c</a>")
 
+-- A malformed pattern is the operator's error, so that rule is skipped and
+-- the next one for the key still runs.
+h.load_with(script, { { "local rules = {", "local rules = { { key = \"Fixes\", pattern = \"(%x+\", url = \"https://x/%s\" }," } })
+out = render("Fixes", "1234567")
+h.equals("a malformed rule is skipped for the next one", out, "<a href='./?id=1234567'>1234567</a>")
+
+-- Only http and https links are drawn, so another scheme stays text.
+out = render("Link", "javascript://x")
+h.equals("a url of any other scheme stays text", out, "javascript://x")
+
+h.load_with(script, { { "local rules = {", "local rules = { { pattern = \"^T(%d+)$\", url = \"https://t/%s\" }," } })
+out = render("Whatever", "T12")
+h.equals("a rule without a key applies to every trailer", out, "<a href='https://t/12'>T12</a>")
+
+h.load_with(script, { { "local link_urls = true", "local link_urls = false" } })
+out = render("Link", "https://example.com/x")
+h.equals("bare urls can be left as text", out, "https://example.com/x")
+
+h.load_with(script, {
+	{ "-- { key = \"CVE\"", "{ key = \"CVE\"" },
+	{ "--   url = \"https://www.cve.org", "  url = \"https://www.cve.org" },
+})
+out = render("CVE", "CVE-2024-12345")
+h.equals("the shipped CVE example links to its record", out,
+	"<a href='https://www.cve.org/CVERecord?id=CVE-2024-12345'>CVE-2024-12345</a>")
+
 h.finish()
-- 
cgit 2.12.1